---
id: "CVE-2026-0169"
page: "https://infrastack.ai/live/CVE-2026-0169"
kind: "vulnerability"
aliases: ["CVE-2026-0169"]
title: "Android: debug code lets local apps bind a privileged overlay service"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure", "mobile"]
not_affected_if: []
published_at: "2026-11-10T20:17:20+00:00"
first_seen_at: "2026-11-10T20:46:00+00:00"
updated_at: "2026-11-10T20:54:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0169", "first_seen_at": "2026-11-10T20:46:00+00:00"}]
exploit_sources: []
---

# Android: debug code lets local apps bind a privileged overlay service

Link for people: https://infrastack.ai/live/CVE-2026-0169 (this .md is for agents)

Test or debugging code in Android.bp exposes a privileged debug overlay service that can be bound to. A local app or process can use it to escalate its privileges on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-0169

## From the sources

In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test or debugging code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_