CVE-2026-0070: Input Validation
In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Limit and control local access to affected devices: restrict who can log in or run local code, disable or tightly control any management interfaces accessible to local users or untrusted processes, and enforce physical/device access controls to reduce the risk of a local actor triggering the issue.
- Operational
Monitor vendor/security advisories for a vendor-supplied fix for the issue in DevicePolicyManagerService.java and plan to test and deploy the vendor patch promptly once published (no fixed versions were listed in the advisory).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0070?
CVE-2026-0070 has a medium severity rating of 5.5 according to the CVSS 3.1 metrics.
How does CVE-2026-0070 affect Google Android devices?
CVE-2026-0070 can lead to a local denial of service by hiding a system critical package due to improper input validation.
What versions of Android are impacted by CVE-2026-0070?
CVE-2026-0070 affects Google Android and Google Android Framework, though specific version details are not provided.
Is user interaction required to exploit CVE-2026-0070?
No, user interaction is not needed for the exploitation of CVE-2026-0070.
What mitigation strategies are recommended for CVE-2026-0070?
Mitigation for CVE-2026-0070 involves applying the latest security updates from Google to ensure proper input validation.