CVE-2026-49881

CVE-2026-49881 is a local privilege escalation flaw in Android caused by a logic error in the serviceClassExists function of InCallController.java, part of the Telecom framework that handles call-related services. The flawed service-class check can lead to arbitrary code execution, and exploitation requires no user interaction and no privileges beyond those a local low-privileged app already holds (AV:L/PR:L/UI:N per the CVSS vector). An attacker who can run code on the device, for example through a malicious installed app, could escalate privileges with high impact on confidentiality, integrity, and availability. Affected parties are Android devices running builds of the Telecom/InCallController component containing the flawed logic; the available data does not specify exact affected version ranges. Exploitation status: no public proof-of-concept, no CISA KEV listing, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Apply the Android security update from Google or your device manufacturer once it includes CVE-2026-49881, and verify your device's security patch level in Settings > About phone; because no affected version ranges are provided, check the Android Security Bulletin and vendor advisories for this CVE. Until patched, limit installation of untrusted apps, since exploitation requires locally executing low-privileged code and needs no user interaction. No workarounds are described in the available data.