Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-0091. PoCs published by canyie.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-0091, leveraging Android's WindowOrganizer to register a malicious ITransitionPlayer that intercepts transition requests and executes arbitrary code via a BroadcastReceiver. The exploit demonstrates privilege escalation by fabricating overlays and executing shell commands in the context of another application.
Description
In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Exploits (1)
This repository contains a functional exploit for CVE-2026-0091, leveraging Android's WindowOrganizer to register a malicious ITransitionPlayer that intercepts transition requests and executes arbitrary code via a BroadcastReceiver. The exploit demonstrates privilege escalation by fabricating overlays and executing shell commands in the context of another application.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H