A flaw baked into Android's own file-picker system means a malicious app already on your phone could silently promote itself to a level of system trust it was never supposed to have — and you wouldn't feel a thing.
Who's at Risk — and How Many People Is That?
Android powers roughly 3.3 billion active devices worldwide. CVE-2026-0013 affects the DocumentsUI system component — the built-in file picker that appears every time you open an attachment, save a download, or grant an app access to your storage. That screen is on virtually every Android phone, tablet, and Chromebook running a vulnerable version of the OS.
The practical impact touches anyone who has ever installed an app from outside the official Play Store, lives in a region with a heavy third-party app ecosystem, or uses a device that is slow to receive manufacturer security updates — which, let's be honest, describes the majority of Android users on the planet. Enterprise teams managing fleets of Android devices for field workers or logistics operations should treat this as a priority item.
What's Actually Happening Here — In Plain English
Imagine your phone's file manager is a security guard with a master key. It has special permission to open doors in your phone's system that ordinary apps cannot touch. Now imagine a con artist who figures out that if they stand directly behind the guard and shout an instruction, the guard will act on it without checking who gave the order. That con artist just used the guard's master key without ever having to steal it. That's essentially what this vulnerability allows.
Every Android app lives in its own walled garden. Apps communicate with each other by sending small packages of instructions called "intents" — basically little messages that say "open this," "do that," "show the user this screen." The system is designed so that certain powerful, trusted system apps — like DocumentsUI, which manages your files — can launch screens and functions that regular apps simply aren't allowed to reach on their own. CVE-2026-0013 breaks that gate. Due to a flaw in a piece of code called setupLayout inside PickActivity.java, a rogue app can craft a message that tricks DocumentsUI into launching any activity on the device — including restricted system screens — as if DocumentsUI itself requested it. The file manager becomes an unwitting accomplice.
What makes this especially unsettling is that the entire attack is passive. The malicious app doesn't need to wait for you to tap a button, open a file, or approve a permission dialog. It fires its malicious instruction in the background, DocumentsUI carries it out without question, and suddenly the attacker's app is operating with a level of system privilege it was never granted. From there, an attacker could access protected settings, silently install additional components, read data from other apps, or lay groundwork for a more complete device takeover.
The Technical Anchor: A Confused Deputy in PickActivity
For the security researchers in the room: this is a classic confused deputy attack — a privilege escalation class where a higher-privileged program (the "deputy") is manipulated into performing actions on behalf of a lower-privileged requester. The vulnerable surface is the setupLayout() method within PickActivity.java in the DocumentsUI package. Because the intent handling in this method does not adequately validate the origin or destination of the activity start request, an unprivileged third-party app can supply a crafted intent that DocumentsUI will forward with its own elevated identity. The vulnerability is classified as a local privilege escalation, requires no additional execution privileges, and critically, requires zero user interaction. It carries a CVSS score of 8.4 (HIGH).
CVE ID: CVE-2026-0013
CVSS Score: 8.4 (HIGH)
Vulnerability Class: Confused Deputy / Intent Hijacking / Local Privilege Escalation
Affected Component:PickActivity.java— DocumentsUI (Android)
User Interaction Required: None
Additional Privileges Required: None
Has Anyone Used This in the Wild?
As of publication, no active exploitation has been confirmed. There are no known campaigns, malware families, or threat actor groups currently linked to CVE-2026-0013. However, that picture can change quickly once a CVE is public — particularly for a zero-interaction, high-CVSS vulnerability on a platform as ubiquitous as Android. Security teams should not interpret "no known exploitation" as "safe to delay." The attack surface here is enormous, the barrier to exploitation is low, and the building blocks (a malicious app already installed on the device) are well within the reach of common spyware distributors, stalkerware authors, and even nation-state toolkits that stage attacks in multiple steps.
The vulnerability was surfaced through Android's standard security disclosure process. Researchers and defenders are encouraged to monitor Android Security Bulletins for patch confirmation and to watch threat intelligence feeds for proof-of-concept code, which historically appears within days to weeks of high-profile Android CVE disclosures.
What You Should Do Right Now
Whether you're a regular user or a security professional managing devices, here are three concrete steps to take today:
- Update Android immediately — and don't stop at the OS. Go to Settings → System → Software Update (exact wording varies by manufacturer) and install any pending updates. Once patched builds are confirmed in the Android Security Bulletin, you're looking for a security patch level dated 2026-01-01 or later that addresses this CVE. Also update the DocumentsUI / Files app through the Play Store, as Google can sometimes push component-level fixes independently of a full OS update.
- Audit and delete apps from unknown sources. This attack requires a malicious app to already be on your device. Go to Settings → Apps and sort by install date. Remove anything you don't recognize, anything installed from outside the Play Store that you no longer actively use, and any apps that requested unusually broad permissions at install. On Android 12 and later, you can review permission history under Settings → Privacy → Permission Manager.
-
Enterprise and security teams: prioritize detection over waiting for patches. If you manage Android fleets through an MDM (Mobile Device Management) platform such as Microsoft Intune, VMware Workspace ONE, or Google Endpoint Management, create a compliance policy that flags devices without the relevant patch level and restricts their access to sensitive corporate resources. Additionally, review EDR or mobile threat defense (MTD) telemetry for any anomalous
DocumentsUIactivity or unexpected activity launches sourced from third-party packages — that's your early warning signal.
CVE-2026-0013 was disclosed with a CVSS score of 8.4 (HIGH). No active exploitation has been confirmed at time of publication. This article will be updated as patch availability and threat actor activity develop. Security professionals should monitor the Android Security Bulletins for official patch confirmation.