{"id":"CVE-2026-55270","published":"2026-10-05T19:17:24.097","lastModified":"2026-10-07T15:15:06.443","description":"In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":["google"],"products":["android"],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability in Google's Android dialInternal function allows local attackers to bypass permissions and escalate privileges without needing user interaction. This affects multiple locations in the Android system.","exploitability":"Exploitation is relatively straightforward as it requires only local access with existing user privileges, no additional execution privileges or user interaction are needed.","blast_radius":"The impact could be significant across Android devices as local privilege escalation can lead to full system compromise, affecting all users and applications on the device.","remediation":"Upgrade to Android 15 or later, as this vulnerability was addressed in that release.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","confused-deputy","android"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:57:12.025Z"}}