CVE-2026-0078: Input Validation
In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until the code fix is deployed, restrict or harden local access that can invoke DevicePolicyManagerService/setGlobalProxy (for example, limit untrusted local accounts and apps, restrict management interfaces to trusted administrators) to reduce the risk of local exploitation.
- Operational
Fix the code in DevicePolicyManagerService.java: add proper input validation and ensure persistence operations in setGlobalProxy are synchronized to prevent desynchronization that can lead to local privilege escalation.
- Operational
After implementing the fix, deploy and test the patch across affected systems and monitor for attempts to exploit local privilege escalation related to setGlobalProxy.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0078?
CVE-2026-0078 has a high severity score of 7.8 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-0078?
To fix CVE-2026-0078, update your Google Android software to the latest version that addresses this vulnerability.
What is the potential impact of CVE-2026-0078?
CVE-2026-0078 can lead to local escalation of privilege due to improper input validation.
Is user interaction required to exploit CVE-2026-0078?
No, user interaction is not required for the exploitation of CVE-2026-0078.
Which component is affected by CVE-2026-0078?
CVE-2026-0078 affects the DevicePolicyManagerService component in Google Android.