CVE-2026-0072 - Android InputMethodManagerService Privilege Escalation

System administrators should apply security patches released by Google on June 1, 2026, to address a critical vulnerability affecting Android. The flaw, identified as CVE-2026-0072, resides in the InputMethodManagerService and allows for local privilege escalation without requiring user interaction. The vulnerability stems from a missing permission check in the addInputMethodListener function, which could permit unauthorized access to system services. Google has assigned a maximum CVSS 4.0 score of 10.0 to the issue, classifying it as critical. The company recommends implementing missing permission checks and reviewing other methods within the service for similar authorization flaws.