Android: Critical RCE and Privilege Escalation Flaws Disclosed Together

Key findings

• Critical RCE vulnerability CVE-2026-55330 disclosed in Android's Bluetooth component.
• Three privilege escalation flaws (CVE-2026-56952, CVE-2026-0198, CVE-2026-28625) patched in a single batch.
• Vulnerabilities stem from missing permission checks and logic errors in core Android components.
• Exploitation for all disclosed CVEs requires no user interaction.

On October 5 and 6, 2026, Google disclosed a batch of four vulnerabilities affecting the Android operating system. The disclosures, clustered within a 24-hour window, include a critical remote code execution flaw and three privilege escalation vulnerabilities. These findings underscore ongoing challenges in Android's permission handling and input validation mechanisms.

The most severe vulnerability, CVE-2026-55330, is a critical use-after-free flaw in the Bluetooth component. Exploitable remotely without user interaction, it could lead to code execution with system-level privileges. This critical bug was disclosed on October 6, 2026.

Also disclosed on October 6, 2026, were two medium-severity privilege escalation vulnerabilities. CVE-2026-56952, found in platform_msg_handler_init, and CVE-2026-0198, located in is_pd_allowed, both stem from missing permission checks. These flaws could allow a local attacker to escalate privileges to System execution.

A high-severity privilege escalation vulnerability, CVE-2026-28625, was disclosed on October 5, 2026. This vulnerability, stemming from a logic error in multiple locations within the Android framework, allows for local privilege escalation without requiring additional execution privileges or user interaction.

The batch of vulnerabilities highlights potential weaknesses in core Android components, particularly concerning permission checks and memory management. While CVE-2026-55330 presents a critical remote code execution risk, the other three CVEs focus on local privilege escalation, indicating a need for continued vigilance in securing device access and data. Users are advised to ensure their Android devices are updated to the latest security patch to mitigate these risks.

The vulnerabilities were disclosed by Google, with related coverage from Vypr Intelligence noting the simultaneous disclosure of three medium-severity flaws, including privilege escalation. The specific patches and affected versions for this batch are not detailed in the provided information, but users should always apply the latest available security updates from Google.

This cluster of vulnerabilities serves as a reminder of the complex security landscape of mobile operating systems and the importance of timely patching by both vendors and users. The simultaneous disclosure of these flaws suggests a coordinated effort by Google to address multiple security weaknesses within its Android platform.