Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.2

Google Android framework can be crashed by app restrictions

CVE-2026-59008 · published 4 days ago
Summary

The core Android system code that manages device policies can be forced to use up resources, causing the device to become unresponsive. This does not require any special permissions or user interaction, so a malicious app could make the device stop working. Update the device to the latest security patch or remove untrusted apps that might exploit this behavior.

What to do
  • Update google platform/frameworks/base to version 17-qpr2-next:2026-11-01.
  • Update google platform/frameworks/base to version 16-qpr2:2026-11-01.
  • Update google platform/frameworks/base to version 17:2026-11-01.
Affected software
Ecosystem VendorProductAffected versions
– google android 17
Android google platform/frameworks/base >= 17-qpr2-next:0, < 17-qpr2-next:2026-11-01
>= 16-qpr2:0, < 16-qpr2:2026-11-01
>= 17:0, < 17:2026-11-01
Fix: upgrade to 17-qpr2-next:2026-11-01
Original advisory text
In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional exe...
In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.2 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published1 Nov 2026
Updated4 Nov 2026
First seen2 Nov 2026
Sources
ASB-A-281543351 · OSV
CVE-2026-59008 · NVD
CVE-2026-59008 · MITRE
Track software like this
Free during beta