CVE-2026-49919

CVE-2026-49919 is an integer overflow in tt_face_colr_blend_layer in ttcolr.c, the code that blends COLR (color font) glyph layers in the Android platform's font rendering stack. It is triggered when the system processes a crafted color font whose layer values overflow the integer arithmetic in the blending routine, and no user interaction is required for exploitation. A successful attack could lead to remote code execution within the affected component and, per the advisory, local escalation of privilege without requiring any additional execution privileges. Affected users are those running Android builds that include the vulnerable font rendering code, which Google has fixed in the September 2026 Android security update (specific version ranges were not enumerated in the available data). Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Apply the September 2026 Android security update (or your device vendor's patch incorporating it) as soon as it is distributed, and verify in Settings that the Android security patch level is September 2026 or later. Because exploitation requires no user interaction and no special privileges, patching is the primary mitigation; enterprises should track OEM rollout and monitor CISA KEV and Android bulletins for changes in exploitation status.