CVE-2026-0098

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description In the getCallingPackageName() function of Shared.java, a confused deputy issue allows for the bypass of activity start restrictions. This flaw enables local escalation of privilege without requiring additional execution privileges or user interaction. A confused deputy is a security issue where a privileged entity is tricked by a less privileged entity into performing an action on its behalf.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.