Android Framework and System Resource Types Out-of-Bounds Read Vulnerability Allowing Local Privilege Escalation

A vulnerability has been identified in the Android Framework and System components, specifically within the ResourceTypes.cpp file. The issue arises from an incorrect bounds check, leading to a potential out-of-bounds read. This vulnerability could be exploited to escalate privileges locally, without requiring additional execution privileges or user interaction. Devices with a security patch level prior to 2026-06-01 are affected.

Impact

Exploitation of this vulnerability could result in unauthorized privilege escalation, allowing a user to gain elevated rights or access within the system.

Remediation

Users can update their devices to the June 2026 security patch level to address this vulnerability. For some devices on Android 10 and later, the Google Play system update will also include this patch. Instructions for checking and updating the Android version are available on the Google Play support page.