CVE-2026-0047: High severity Google Android vulnerability
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 16-qpr2-next:2026-03-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 16-qpr2:2026-03-01
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0047?
CVE-2026-0047 is classified as a critical vulnerability that allows local escalation of privilege.
How do I fix CVE-2026-0047?
To fix CVE-2026-0047, ensure that your affected Android version is updated to a secure release that addresses this vulnerability.
What versions of Android are affected by CVE-2026-0047?
CVE-2026-0047 affects Google Android versions 16.0-qpr2_beta_1, 16.0-qpr2_beta_2, and 16.0-qpr2_beta_3.
What kind of exploitation is possible with CVE-2026-0047?
CVE-2026-0047 allows an app to access private information without user interaction, due to a missing permission check.
Is user interaction required for exploiting CVE-2026-0047?
No, user interaction is not needed for the exploitation of CVE-2026-0047.