CVE-2026-0098: High severity Android Android vulnerability
In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0098?
CVE-2026-0098 has a severity rating of 7.8 on the CVSS scale, indicating a high risk.
What impact does CVE-2026-0098 have on Android security?
CVE-2026-0098 allows for a potential local escalation of privilege without requiring user interaction.
How can CVE-2026-0098 be mitigated?
To mitigate CVE-2026-0098, it's recommended to apply the latest security updates provided by Android.
When was CVE-2026-0098 published?
CVE-2026-0098 was published on June 1, 2026.
What does the term 'confused deputy' mean in the context of CVE-2026-0098?
In the context of CVE-2026-0098, a 'confused deputy' refers to a situation where a program mistakenly misuses its authority, allowing unauthorized access or actions.