SECURITY researchers have disclosed CVE-2026-49881, a high-severity logic flaw in Android’s Telecom service, with a CVSSv3 score of 7.8. The issue affects Android 16 QPR3 and later, as well as stable Android 17 builds based on the Android Open Source Project. It allows an unprivileged malicious application, requiring no special permissions beyond installation, to execute arbitrary code in the system server and potentially obtain UID 1000 privileges.
The vulnerability was validated on Google Pixel hardware, but the article says the affected Telecom mainline component could also expose devices from other manufacturers using Android 17.
The flaw is in the `InCallController` class. By invoking `TelecomManager.addCall`, an application can trigger service discovery and cause the system to load a malicious component through an unsafe `createPackageContext` call. A custom `AppComponentFactory` can then execute code in the Telecom context. The article further claims that attackers could manipulate PackageManagerService signature histories to establish persistence.
Technical details and proof-of-concept code have been published on GitHub, although no exploitation in the wild has been confirmed. Google addressed the issue in its September 2026 Android Security Bulletin. Users should install the September 2026 security patch or newer, along with the latest Google Play system update; administrators should prioritise these updates across enterprise fleets.