How to Fix CVE-2026-0011: Android (Bundle Sibling)
By Sai Kiran Pandrala. Last verified: 2026-05-25.
CVE-2026-0011 is a local elevation-of-privilege bug in the Android framework, fixed in the March 2026 Android Security Bulletin alongside CVE-2026-0005 and other issues at the same patch level. The short version: a logic error in the settings/package-management code lets an unprivileged local app defeat a protection mechanism. The fix is the 2026-03-01 security patch level. Everything you need is below.
| Severity | 8.4 (High) · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|---|---|
| Vulnerability type | Local elevation of privilege (CWE-693) |
| Actively exploited? | No, not in CISA KEV; CISA SSVC Exploitation: none |
| Affected | Android 14, 15, 16, 16-qpr2 |
| Fixed in | 2026-03-01 Android security patch level (March 2026 bulletin) |
| Type (CWE) | CWE-693 Protection Mechanism Failure (+ CWE-703) |
Exploitation status
CVE-2026-0011 is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, so there is no U.S.-government-confirmed in-the-wild exploitation on record for it. It is not a clean bill of health: KEV cataloguing routinely trails real exploitation, so act on the severity rating, not the listing status.
Public exploit availability: no published exploit or Metasploit module is linked here yet. Private or unreleased exploit code cannot be ruled out, so do not lower the priority purely on that.
Authoritative references:
What this bug actually is
The vulnerable code lives in enableSystemPackageLPw inside Settings.java, part of the Android package-management and settings subsystem. A logic error there opens a path to prevent location access from working the way the permission model intends. Google classifies the outcome as a local elevation of privilege, and the advisory states plainly that no additional execution privileges are needed and no user interaction is required to exploit it.
The CWE tells you the shape of the flaw. CWE-693 (Protection Mechanism Failure) means a security control that is supposed to be enforced gets bypassed or defeated. The secondary mapping, CWE-703 (Improper Check or Handling of Exceptional Conditions), points at the root cause: a code path that mishandles a condition it should have rejected. Put together, the picture is a settings-layer logic slip that lets a local app reach a state it should not be able to reach, with location-access enforcement as the casualty.
This is not remote code execution and it is not a network-reachable bug. The attack vector is LOCAL, which on Android means malicious or compromised code already running on the device, a sideloaded app, a malicious update to an installed app, or a second-stage payload from an earlier compromise. The danger is what that local code can escalate to once this protection mechanism fails.
Blast radius and why the score is 8.4
The CVSS v3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scoring 8.4 (High). Walk it field by field, because every High in there matters:
- AV:L (Local), the attacker needs code on the device, not network reach. That caps the reach but it is a low bar on a phone that sideloads apps.
- AC:L (Low complexity), no special timing, race window, or unusual configuration is required to trigger the logic error.
- PR:N (No privileges required), this is the sting. An unprivileged local app can trip the flaw. It does not need to be root or hold sensitive permissions first.
- UI:N (No user interaction), the victim taps nothing and approves nothing. Exploitation can happen silently in the background.
- S:U (Scope unchanged), C:H/I:H/A:H, once escalated, the impact to confidentiality, integrity, and availability is total within the affected security context.
An unprivileged app reaching High-impact privilege with zero user interaction is exactly why an 8.4 lands in the High band rather than Medium. The location-access angle is the user-visible symptom; the privilege escalation underneath is the security problem.
Who is affected
Google lists these as affected: Android 14, Android 15, Android 16, and Android 16-qpr2. The default status for everything else is unaffected, so older or unlisted branches are out of scope per the record. There is no separate OEM-specific carve-out in this CVE; it is an AOSP-level fix that flows out through the March 2026 Android security patch level.
The fix: apply the March 2026 security patch level
This is a software vulnerability in the Android OS, so the remediation is the Android security patch, not a hardware or firmware-flashing exercise. Google shipped the fix in the 2026-03-01 security patch level, documented in the March 2026 Android Security Bulletin.
On a standard consumer or fleet device, here is the real path:
- Check your current patch level. On the device, open Settings → About phone → Android version and read the Android security update field. You want a date of March 1, 2026 (2026-03-01) or later. Anything earlier is still exposed.
- Pull the update. Go to Settings → System → System update (path varies slightly by OEM) and check for updates. The fix reaches devices as part of the monthly OEM security rollout that carries the 2026-03-01 (or later) patch string.
- Reboot and re-verify. After the update installs and the device reboots, return to About phone and confirm the security update date is now 2026-03-01 or later.
- For managed fleets, push the update through your MDM/EMM (for example Android Enterprise managed Google Play, or your OEM's enterprise update channel) and gate device compliance on the minimum security patch level. Most EMM consoles let you set a compliance rule requiring a minimum patch date, set it to 2026-03-01.
The only authoritative source for the fixed build and the exact patch string is the vendor advisory: the March 2026 Android Security Bulletin. Note that OEMs (Samsung, Pixel, Xiaomi, and others) ship their own monthly bulletins that incorporate the AOSP fix on their own timelines; if your device is from a third-party OEM, the relevant rollout is that vendor's March 2026 (or later) security update.
Do not reach for a package manager here. There is no apt, dnf, or winget command that patches an Android OS CVE, the fix is the OTA security update delivered by Google or your OEM. AOSP/custom-ROM builders should cherry-pick the corresponding fix from the AOSP security branch referenced in the bulletin and rebuild.
If you cannot patch immediately
There is no clean configuration toggle that closes this flaw without the patch, because it is a logic error in framework code. The honest mitigations until the update lands are operational:
- Stop sideloading. Because the attack vector is local, the practical entry point is untrusted code on the device. Keep Install unknown apps disabled and source apps only from the managed/official store.
- Audit installed apps. Remove anything you do not recognize or no longer use, especially recently sideloaded packages, before the patch reaches you.
- Keep Google Play Protect on. It will not patch the bug, but it adds a detection layer against known malicious apps that might try to chain a local EoP.
- On managed devices, tighten app-install policy to allowlist-only and watch for the security-patch-level compliance flag flipping green once the rollout reaches your fleet.
Exploitation reality check
Per the CISA SSVC assessment recorded against this CVE, Exploitation is rated "none" and the bug is not Automatable, though Technical Impact is "total." In plain terms: as of the record, there is no observed in-the-wild exploitation and no reliable mass-exploitation path, but if someone does exploit it the impact is complete. That argues for patching on your normal monthly Android security cadence rather than treating it as a fire drill, but it is still a High, so do not let it slip past the next maintenance window.
Frequently asked questions
Is CVE-2026-0011 remote code execution?
No. It is a local elevation of privilege (CWE-693 protection mechanism failure). The CVSS attack vector is Local, so an attacker needs code already running on the device, so it cannot be triggered over the network.
Which Android versions need the fix?
Android 14, 15, 16, and 16-qpr2 are listed as affected. Confirm your device is on the 2026-03-01 security patch level or later to be covered.
Is CVE-2026-0011 in the CISA KEV catalog or actively exploited?
No. There is no CISA KEV listing for it, and the CISA SSVC assessment rates Exploitation as "none", meaning no confirmed in-the-wild exploitation on record. No public exploit or Metasploit module is linked in the primary references. Patch on your normal monthly cadence.
Can I fix this with a package manager or registry change?
No. This is an Android OS framework bug. The only fix is the monthly Android security update (the 2026-03-01 patch level or later) delivered OTA by Google or your OEM. There is no apt/dnf/winget command and no app-store update that closes it.
Where is the official advisory?
The March 2026 Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01.
References
- Official vendor advisory: https://source.android.com/docs/security/bulletin/2026/2026-03-01
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-0011
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- March 2026 Android Security Bulletin (vendor advisory): https://source.android.com/docs/security/bulletin/2026/2026-03-01
Written by Sai Kiran Pandrala, Sai Kiran Pandrala. Grounded in the Google Android CVE record and the March 2026 Android Security Bulletin.
Related fixes
Related guides worth a look while you sort this one out:
- How to Fix CVE-2026-0005: Information exposure in Android
- How to Fix CVE-2026-0006: Heap Buffer Overflow in Android 16
- How to Fix CVE-2026-0007: Android Tapjacking Privilege Escalation
- How to Fix CVE-2026-0008: Cwe-441 unintended proxy or intermediary ('confused deputy') in Android
- How to Fix CVE-2026-0010: Out-of-bounds Write in Android DRM Manager
- How to Fix CVE-2026-0012: Android Notification Contact-Name Leak
People also ask
Which Android versions are affected by CVE-2026-0011?
Android 14, 15, 16, and 16-qpr2. Confirm your device shows the 2026-03-01 security patch level or later under Settings → About phone to be covered.
Is CVE-2026-0011 listed in CISA KEV or actively exploited?
No. There is no CISA KEV listing, and the CISA SSVC assessment rates Exploitation as "none", no confirmed in-the-wild exploitation on record. Patch on your normal monthly Android cadence.
How do I fix CVE-2026-0011?
Apply the monthly Android security update carrying the 2026-03-01 patch level or later, delivered OTA by Google or your OEM. There is no package-manager fix for an OS framework bug.