CVE-2026-0049

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

Google · Android

CVSS v3.1 CNA

6.2 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.10% chance of exploitation in the next 30 days, 1st percentile

Published

2026-04-06

Updated

2026-05-27

Proof-of-concept exploits (1)

• R3n3r0/CVE-2026-00490★ · 2026-08-07

Security advisories

• https://source.android.com/docs/security/bulletin/2026/2026-04-01

References

• CVE Record
• NVD entry

Related

• CVE-2024-26256
• CVE-2025-5915
• CVE-2026-20700
• CVE-2026-27280