Do Son 
TL;DR
A critical logic flaw exists in the Android 17 Telecom service. The Android Telecom vulnerability allows unprivileged applications to execute arbitrary code within the system server. Furthermore, the details of the vulnerability and the proof-of-concept exploit code have been publicly disclosed. Users must apply the latest security patches to mitigate this severe threat.
- CVE: CVE-2026-49881
- CVSS: 7.8 (High · CVSSv3)
- Product: Google Android
- Affected: 17
- Impact: In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due...
- Status: No confirmed exploitation yet
- EPSS: 0.1% (30-day)
- Action: See vendor advisory
Track every Google CVE the moment it's exploited.
Get free email alertsWhy It Matters
This Android Telecom vulnerability poses a massive risk to mobile security. Specifically, it enables a malicious app to gain root-level privileges (UID 1000) without any user interaction. The attacker requires no special permissions beyond standard installation. A successful exploit grants the attacker persistent control over the device. This control survives even after applying future over-the-air updates. Currently, no exploitation in the wild has been confirmed. However, the details of the vulnerability and the proof-of-concept exploit code have been publicly disclosed on GitHub. This disclosure drastically lowers the barrier to entry for threat actors. Consequently, millions of devices running modern Android builds are highly susceptible to silent compromise.
How The Attack Works
The vulnerability resides within the InCallController class of the Telecom service. When a call occurs, the system attempts to discover available services using getInCallServiceComponents. An attacker can trigger this enumeration on-demand via the TelecomManager.addCall API. The system then executes serviceClassExists against any component declaring an InCallService intent.
Crucially, the system uses createPackageContext with the dangerous CONTEXT_IGNORE_SECURITY flag. While developers intended to prevent foreign class initialization during Class.forName, the flaw triggers earlier. As noted in the analysis, “the damage is already done by getClassLoader on the foreign context.” If the malicious app defines a custom AppComponentFactory, the system executes it automatically. This action immediately yields arbitrary code execution within the Telecom context. The attacker then reflects into the PackageManagerService to manipulate signature histories and achieve persistence.
Affected Versions
This vulnerability actively impacts devices running Android 16 QPR3 and subsequent versions. Furthermore, it affects stable releases of Android 17 built from the Android Open Source Project (AOSP). While initially validated on Google Pixel hardware, the core vulnerability impacts the universal Telecom mainline component. Therefore, devices from other original equipment manufacturers utilizing Android 17 face identical exposure.
Patch Or Mitigation Steps
Google resolved this critical issue in the September 2026 Android Security Bulletin. Users must verify that their devices run the September 2026 security patch level or newer. Because Telecom operates as a mainline component in Android 17, users must also install the latest Google Play system updates. System administrators managing enterprise fleets should enforce these updates immediately. Finally, users should ensure Google Play Protect remains enabled to block known malicious applications.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
