CVE-2026-0021
published 2026-03-02CVE-2026-0021: In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to…
PriorityP346high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.10%
1.0th percentile
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| platform | packages_apps_settings | >= 14:0 < 14:2026-03-01 | 14:2026-03-01 |
| platform | packages_apps_settings | >= 15:0 < 15:2026-03-01 | 15:2026-03-01 |
| platform | packages_apps_settings | >= 16-qpr2-next:0 < 16-qpr2-next:2026-03-01 | 16-qpr2-next:2026-03-01 |
| platform | packages_apps_settings | >= 16-qpr2:0 < 16-qpr2:2026-03-01 | 16-qpr2:2026-03-01 |
| platform | packages_apps_settings | >= 16:0 < 16:2026-03-01 | 16:2026-03-01 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q689-c7qh-hgv3: In hasInteractAcrossUsersFullPermission of AppInfoBase
ghsa_unreviewed·2026-03-02
CVE-2026-0021 [HIGH] CWE-441 GHSA-q689-c7qh-hgv3: In hasInteractAcrossUsersFullPermission of AppInfoBase
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
CVE-2026-0021: In hasInteractAcrossUsersFullPermission of AppInfoBase
osv·2026-03-01
CVE-2026-0021 CVE-2026-0021: In hasInteractAcrossUsersFullPermission of AppInfoBase
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
2026-03-02
Published