CVE-2026-0087: High severity Google Android vulnerability
In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until the code is fixed and deployed, restrict local access to the component or process that performs domain verification and app link handling (apply local ACLs, sandboxing, or limit execution to trusted accounts) to reduce the risk of unprivileged local exploitation.
- Operational
Inspect and correct the logic error in approvalLevelForDomainInternal of DomainVerificationService.java to prevent arbitrary app link hijacking. Rebuild, test, and deploy the patched component; include code review and regression tests to verify the approval logic behaves correctly.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0087?
The severity of CVE-2026-0087 is high with a CVSS score of 7.8.
How do I fix CVE-2026-0087?
To fix CVE-2026-0087, update Google Android to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-0087?
CVE-2026-0087 is a logic error vulnerability that can lead to arbitrary app link hijacking.
What are the potential impacts of CVE-2026-0087?
The potential impacts of CVE-2026-0087 include local escalation of privilege without the need for additional execution privileges.
Is user interaction required to exploit CVE-2026-0087?
No, user interaction is not needed to exploit CVE-2026-0087.