CRITICAL🇵🇱 Wersja polska

CVE-2026-0072

CVSS 10.0v4.0pub. 2026-06-01upd. 2026-06-03

In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The addInputMethodListener method in the com.android.server.inputmethod.InputMethodManagerService class does not perform required permission verification before registering an input method listener. This means any application running locally on the device can invoke this method without possessing appropriate permissions. As a result, an attacker can abuse this mechanism to obtain higher privileges in the system.

Impact

An attacker with local access to the device can achieve privilege escalation and perform operations with higher system privileges than they are authorized for. User interaction is not required to conduct the attack.

Mitigation & patch

Apply patches available from the manufacturer according to references — Android XR security bulletin published 2026-06-01 at https://source.android.com/docs/security/bulletin/xr/2026/2026-06-01

Who is affected

Devices running Android — versions specified in manufacturer references (Android XR security bulletin dated 2026-06-01)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X