CVE-2026-45524
published 2026-10-05CVE-2026-45524: In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege…
PriorityP348high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.07%
0.1th percentile
In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google Android 17 Wifi Permissions WifiPermissionsUtil.java isSystem privileges management (EUVD-2026-92599)
vuldb·2026-10-06·CVSS 8.8
CVE-2026-45524 [HIGH] Google Android 17 Wifi Permissions WifiPermissionsUtil.java isSystem privileges management (EUVD-2026-92599)
A vulnerability labeled as problematic has been found in Google Android 17. The affected element is the function isSystem of the file WifiPermissionsUtil.java of the component Wifi Permissions. Such manipulation leads to improper privilege management.
This vulnerability is listed as CVE-2026-45524. The attack must be carried out locally. There is no available exploit.
A patch should be applied to remediate this issue.
GHSA
In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check.
ghsa_unreviewed·2026-10-05
CVE-2026-45524 [HIGH] CWE-862 In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check.
In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-05
Published