CVE-2026-0072: Critical severity Android Android InputMethodManagerService vulnerability
In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a permission check in addInputMethodListener to validate the caller's permissions (e.g., verify calling UID/required permission) before registering input method listeners to prevent unauthorized local escalation of privilege.
com.android.server.inputmethod.InputMethodManagerService addInputMethodListener permission = enforce permission check
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0072?
CVE-2026-0072 has a critical severity rating of 10.
What type of vulnerability is CVE-2026-0072?
CVE-2026-0072 is a local escalation of privilege vulnerability due to a missing permission check.
How do I fix CVE-2026-0072?
To fix CVE-2026-0072, ensure that the latest security patches for the Android InputMethodManagerService are applied.
Can CVE-2026-0072 be exploited without user interaction?
Yes, CVE-2026-0072 can be exploited without any user interaction required.
What software is affected by CVE-2026-0072?
CVE-2026-0072 affects the Android InputMethodManagerService.