The vulnerability CVE-2026-0130 affects Google Android and arises from a heap buffer overflow in the RtcpChunk::decodeRtcpChunk function, which results in a possible out of bounds read. This memory safety issue can be exploited remotely to disclose information without needing elevated execution privileges. However, exploitation requires user interaction. There is no CVSS score assigned and no vendor advisory or patch information currently available.

Successful exploitation of this vulnerability could allow an attacker to remotely disclose information from the affected Android device's memory. No additional execution privileges are required, but user interaction is necessary to trigger the vulnerability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted content that might trigger this vulnerability and avoid interacting with suspicious inputs that could exploit the RtcpChunk::decodeRtcpChunk function.