CVE-2026-0070: Input Validation
In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 17-next:2026-06-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 15:2026-06-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 16:2026-06-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 16-qpr2:2026-06-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14:2026-06-01
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0070?
CVE-2026-0070 has a medium severity rating of 5.5 according to the CVSS 3.1 metrics.
How does CVE-2026-0070 affect Google Android devices?
CVE-2026-0070 can lead to a local denial of service by hiding a system critical package due to improper input validation.
What versions of Android are impacted by CVE-2026-0070?
CVE-2026-0070 affects Google Android and Google Android Framework, though specific version details are not provided.
Is user interaction required to exploit CVE-2026-0070?
No, user interaction is not needed for the exploitation of CVE-2026-0070.
What mitigation strategies are recommended for CVE-2026-0070?
Mitigation for CVE-2026-0070 involves applying the latest security updates from Google to ensure proper input validation.