CVE-2026-0065

A logic error in the areBackgroundActivityStartsAllowed function of BackgroundLaunchProcessController.java lets activities be launched in the background through an unintended path, bypassing Android's background activity start restrictions. An attacker who already runs code on the device with user-level (normal app) privileges can trigger the flaw locally, and no user interaction is required. Successful exploitation yields local escalation of privilege, with high impact on confidentiality, integrity, and availability reflected in the CVSS 3.1 score of 7.8. The flaw resides in Android platform framework code maintained by Google's Android security team, but the provided data does not enumerate specific affected or patched version ranges. No public proof of concept is known, the issue is not in CISA's KEV catalog, and EPSS assigns only a 0.1% probability of exploitation within 30 days.

What to do: Install the Android security update addressing CVE-2026-0065 as soon as it appears in the Android Security Bulletin and reaches your device via OTA, then verify the new patch level under Settings > About phone > Android security update. Enterprises should confirm managed fleets receive the bulletin's patch level and treat sideloaded or low-trust apps as the primary local attack vector until devices are patched. Since exploitation requires no user interaction, patching rather than user training is the primary mitigation.