medium · CVSS v3 5.5

CVE-2026-55264

The CVE-2026-55264 flaw in Android's DownloadProvider allows local information disclosure without user interaction. It stems from a confused

Overview

The CVE-2026-55264 flaw in Android's DownloadProvider allows local information disclosure without user interaction. It stems from a confused deputy bug in checkWhetherCallingAppHasAccess. The vulnerability can expose sensitive data to any app on the device.

Description

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Impact

Confidentiality is compromised as attackers can read data the app is allowed to access. Integrity remains intact, and availability is unaffected. Defenders must consider that any local app could potentially exploit the flaw.

Remediation

Apply the latest Android security patch that fixes the permission check in DownloadProvider. If patching is delayed, restrict the use of DownloadProvider via app permissions or disable it for sensitive data. Monitor for abnormal file access patterns and enforce least‑privilege for apps.

Risk context

The vulnerability has a medium severity score (CVSS 5.5) and no EPSS data, indicating a moderate but not urgent risk. Defenders should prioritize patching in line with their update cadence.

Affected products

  • Android
  • Google Android OS
  • DownloadProvider
  • Android System
  • Android Framework
  • Android OS

Scores

Severity
medium
CVSS v2
2.1
CVSS v3
5.5
CVSS v4
—
EPSS
—

information-leak confused-deputy local-disclosure Android DownloadProvider medium-severity

← All CVEs

Related CVEs

medium

CVE-2026-105605

An IDOR flaw in the Joomla DJ-Classifieds extension allows any logged‑in user to retrieve the full details of any advertisement by supplying its numeric ID. The issue exists in all versions prior to 3.11.3 and exposes sensitive advertiser information such as phone numbers, addresses, and prices. It can be exploited without any special privileges or external access.

View analysis

medium

CVE-2026-120237

A flaw in ag-ui-protocol ag-ui up to 0.0.58 allows manipulation of the isInterruptExpired function, leading to excessive resource consumption. The vulnerability can be exploited remotely and an exploit is publicly available. Patching to a fixed version is required to mitigate the risk.

View analysis

medium

CVE-2026-120334

A path‑traversal flaw exists in deepset‑ai farm 0.8.0 and earlier, allowing remote attackers to read arbitrary files via the vocab_filename argument in EmbeddingTokenizer.from_pretrained. The vulnerability is publicly known and can be exploited without authentication. It affects any deployments of the unsupported farm library.

View analysis

medium

CVE-2026-120343

A cross-site scripting (XSS) vulnerability exists in the manageassessment2.php file of the CloudClassroom-PHP-Project. This flaw allows remote attackers to inject malicious scripts via the ExamName and question parameters. The issue is significant because the vendor is unresponsive, leaving users without an official patch.

View analysis