CVE-2026-55271: High severity Google Android vulnerability

Q: Does exploitation require user interaction or additional execution privileges?

No. The vulnerability is rated with no privileges required and no user interaction required for exploitation.

Q: Is this exposed remotely?

No. The attack vector is local, so exploitation requires local access to the affected device or environment.

Q: Which component is identified as affected?

The affected software is identified as Android's Contact Picker package, android/platform/packages/apps/contactspicker, in Google Android.

Published Nov 1, 2026

Updated

In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

3 affected componentsFixes available

android/platform/packages/apps/contactspicker>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/packages/apps/contactspicker>=17:0<17:2026-11-01

17:2026-11-01

Google Android

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require user interaction or additional execution privileges?

No. The vulnerability is rated with no privileges required and no user interaction required for exploitation.

Is this exposed remotely?

No. The attack vector is local, so exploitation requires local access to the affected device or environment.

Which component is identified as affected?

The affected software is identified as Android's Contact Picker package, android/platform/packages/apps/contactspicker, in Google Android.

CVE-2026-55271: High severity Google Android vulnerability

Affected Software

Event History

Frequently Asked Questions

Does exploitation require user interaction or additional execution privileges?

Is this exposed remotely?

Which component is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require user interaction or additional execution privileges?

Is this exposed remotely?

Which component is identified as affected?