CVE-2026-55290: Information disclosure in Google Android

This vulnerability involves an out-of-bounds heap read in the setTo function of ResourceTypes.cpp in Google Android due to a missing bounds check. This flaw can cause local information disclosure without requiring elevated privileges or user interaction. The CVSS score is 3.3 (low severity) with an attack vector of local access and low complexity. The affected versions explicitly include Android versions 14, 15, 16, 16-qpr2, and 17. No known exploits are reported in the wild, and no patch or remediation information is provided in the input data.

An attacker with local access and low privileges can exploit this vulnerability to read out-of-bounds heap memory, potentially disclosing sensitive information. There is no impact on integrity or availability, and no user interaction is required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the input data. Until a patch is available, limit local access to trusted users and monitor vendor communications for updates.