The vulnerability CVE-2026-0082 exists in the tryStartActivity method within NfcDispatcher.java in Google Android. Due to an insecure default permission value, the system may automatically grant special app access permissions improperly. This flaw enables a local attacker to escalate privileges without needing any prior execution privileges or user interaction. The vulnerability is classified under CWE-453 (Improper Check for Unusual or Exceptional Conditions). The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

A local attacker can exploit this vulnerability to gain elevated privileges on an affected Android device without requiring any prior execution privileges or user interaction. This could lead to unauthorized access to sensitive system functions and data, potentially compromising device security and user privacy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users and administrators should monitor Google's security advisories for updates. Until a patch is available, limiting local access to trusted users and avoiding installation of untrusted applications may reduce risk.