Medium · 6.7 CVE-2026-56922 EUVD-2026-78965GHSA-532w-4hxj-43mf

In CPM, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execut…

Published Sep 15, 2026 · Updated Sep 16, 2026 · Assigned by Google_Devices

Vendor: Google Product: Android Platform: Android

Description

In CPM, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	Android kernel	—

Advisories 1

WID-SEC-2026-3407 Pixel Patchday September 2026: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 15, 2026

References

https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01