Android DocumentsUI PickActivity Confused Deputy Privilege Escalation

CVE-2026-0013 is a confused deputy vulnerability in Android's DocumentsUI system app, specifically in the setupLayout method of PickActivity.java. The flaw allows a malicious application — already installed on the device — to craft an intent with a malicious selector that tricks DocumentsUI into launching arbitrary activities under its own elevated identity and permissions. Because DocumentsUI is a privileged system app with broad storage and content-provider access, this effectively bypasses Android's permission sandbox. No user interaction and no special app permissions are required once the malicious app is running. Affected versions are Android 14, 15, and 16. The fix (clearing the selector on copied intents) shipped in the March 2026 security bulletin (patch level 2026-03-01) and is also available through Google Play System Update (Project Mainline).

Google's HIGH / 8.4 rating is technically defensible per the CVSS formula — AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is what you get when a local, no-interaction, no-privilege chain yields full CIA impact. But the score overstates enterprise risk for two reasons. First, the entire chain depends on a malicious app being present on the target device, and enterprise MDM policies, Google Play Protect, and sideloading restrictions make that a non-trivial prerequisite. Second, the blast radius is confined to a single mobile device — there's no lateral movement, no domain escalation, and no fleet-wide impact. The EPSS score of 0.14% (3.9th percentile) and the absence from CISA's KEV catalog corroborate that this is not drawing attacker attention in the wild. For an enterprise fleet with MDM controls, this is a MEDIUM — patch in your normal Android security update cycle, don't scramble.

Sources.

1. Android Security Bulletin — March 2026
2. AOSP Patch Commit (DocumentsUI)
3. OSV — ASB-A-447135012
4. SentinelOne Vulnerability Database — CVE-2026-0013
5. Strix.ai — CVE-2026-0013 Details
6. OpenCVE — CVE-2026-0013
7. HKCERT — Android Multiple Vulnerabilities (March 2026)
8. CyberStrike — CVE-2026-0013 Detail

Run this script from an auditor workstation with adb connected to the target Android device (USB debugging enabled or wireless ADB). Requires adb in PATH. Invoke: bash check_cve_2026_0013.sh. No root required on the device.

#!/usr/bin/env bash
# check_cve_2026_0013.sh — Verify CVE-2026-0013 patch status on connected Android device
# Usage: bash check_cve_2026_0013.sh
# Requires: adb in PATH, one Android device connected
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PATCH_THRESHOLD="2026-03-01"

if ! command -v adb &>/dev/null; then
  echo "UNKNOWN — adb not found in PATH"
  exit 2
fi

DEVICE_COUNT=$(adb devices | grep -c -E '\bdevice$' || true)
if [ "$DEVICE_COUNT" -eq 0 ]; then
  echo "UNKNOWN — no Android device connected via adb"
  exit 2
elif [ "$DEVICE_COUNT" -gt 1 ]; then
  echo "UNKNOWN — multiple devices connected; specify with ANDROID_SERIAL"
  exit 2
fi

SDK=$(adb shell getprop ro.build.version.sdk 2>/dev/null | tr -d '\r')
PATCH_LEVEL=$(adb shell getprop ro.build.version.security_patch 2>/dev/null | tr -d '\r')
MODEL=$(adb shell getprop ro.product.model 2>/dev/null | tr -d '\r')
ANDROID_VER=$(adb shell getprop ro.build.version.release 2>/dev/null | tr -d '\r')

if [ -z "$PATCH_LEVEL" ]; then
  echo "UNKNOWN — could not read security patch level"
  exit 2
fi

echo "Device: $MODEL (Android $ANDROID_VER, SDK $SDK)"
echo "Security patch level: $PATCH_LEVEL"
echo "Required patch level: $PATCH_THRESHOLD"
echo ""

# Check if Android version is affected (14, 15, 16)
MAJOR_VER=$(echo "$ANDROID_VER" | cut -d. -f1)
if [ "$MAJOR_VER" -lt 14 ] 2>/dev/null; then
  echo "PATCHED — Android $ANDROID_VER is not in the affected range (14-16)"
  exit 0
fi

if [ "$MAJOR_VER" -gt 16 ] 2>/dev/null; then
  echo "PATCHED — Android $ANDROID_VER is beyond the affected range"
  exit 0
fi

# Compare patch levels (lexicographic works for YYYY-MM-DD format)
if [[ "$PATCH_LEVEL" < "$PATCH_THRESHOLD" ]]; then
  echo "VULNERABLE — CVE-2026-0013: patch level $PATCH_LEVEL is before $PATCH_THRESHOLD"
  exit 1
else
  echo "PATCHED — CVE-2026-0013: patch level $PATCH_LEVEL meets or exceeds $PATCH_THRESHOLD"
  exit 0
fi