CVE-2026-49880: Elevation of privilege in Google Android

This vulnerability exists in multiple functions within the nfa_nfcee_act.cc source file of Google Android. A missing bounds check leads to a possible out-of-bounds write, which can be exploited locally to escalate privileges without needing further execution privileges or user interaction. The affected versions explicitly include Android 16, 16-qpr2, and 17. No CVSS score is provided, and no known exploits in the wild have been reported.

Successful exploitation can result in local elevation of privilege on affected Android devices, potentially allowing an attacker to gain higher-level access than intended. No user interaction or additional execution privileges are required, increasing the risk of exploitation in local scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data.