CVE-2026-45528

CVE-2026-45528 is a local escalation of privilege vulnerability in Android's StorageManagerService: the getManageSpaceActivityIntent function builds a PendingIntent unsafely, allowing a LaunchAnyWhere-style chain in which an intent supplied by a local app is launched with the system component's privileges (classified as CWE-926, improper export of a security component). An attacker triggers it from local code with no special privileges, but must induce a user interaction (e.g., tapping through the Manage Space flow) for the crafted intent to fire. A successful exploit lets the attacker launch arbitrary activities or intents in a privileged system context, with high impact on the confidentiality, integrity, and availability of the user's data (CVSS 7.3, AV:L/PR:L/UI:R). Anyone running Android on an unpatched device is potentially affected; the source data does not specify the affected Android version ranges. Exploitation status is quiet: no public proof-of-concept, not listed in CISA KEV, and EPSS estimates only a 0.1% chance of exploitation within 30 days.

What to do: Install the Android security update containing the fix for CVE-2026-45528 as soon as it is offered (check Settings > System > System update); note that OEM builds often lag AOSP fixes, so verify your device's security patch level against the Android Security Bulletin. Enterprises should use MDM to enforce patch compliance on managed fleets. Since no PoC or in-the-wild exploitation is known, routine patch cycles are adequate, but prioritize devices with side-loaded or untrusted apps that could exploit the flaw locally.