CVE-2026-0076: High severity Google Android vulnerability
In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until an upstream fix is available, prevent untrusted local users from reaching or executing the component that contains ResourceTypes.cpp: restrict file execution permissions, remove SUID/SGID bits where possible, limit local login and shell access to trusted administrators, and use OS-level confinement (SELinux/AppArmor) or host-based firewall rules to block or isolate execution of the vulnerable component.
- Operational
Monitor host logs for signs of local privilege escalation and suspicious activity related to the component containing ResourceTypes.cpp. If exploitation is suspected, isolate the host, perform incident response, rotate any potentially exposed local privileged credentials, and restore or rebuild systems from known-good sources after remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0076?
The severity of CVE-2026-0076 is high with a CVSS score of 7.8.
How can CVE-2026-0076 be exploited?
CVE-2026-0076 can be exploited through possible out of bounds reads, allowing for local escalation of privilege.
What software is affected by CVE-2026-0076?
CVE-2026-0076 affects Google Android software.
Is user interaction required to exploit CVE-2026-0076?
No, user interaction is not needed for the exploitation of CVE-2026-0076.
What is the potential impact of CVE-2026-0076?
The potential impact of CVE-2026-0076 includes local escalation of privilege without needing additional execution privileges.