Search
Find a vulnerability
Search criteria
35185 vulnerabilities by google
CERTFR-2026-AVI-1443
Vulnerability from certfr_avis - Published: 2026-11-03 - Updated: 2026-11-03
De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android toutes versions sans le correctif de s\u00e9curit\u00e9 du 1 novembre 2026.",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-20546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20546"
},
{
"name": "CVE-2026-58990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58990"
},
{
"name": "CVE-2026-20548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20548"
},
{
"name": "CVE-2026-58886",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58886"
},
{
"name": "CVE-2026-58943",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58943"
},
{
"name": "CVE-2026-55275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55275"
},
{
"name": "CVE-2026-80335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80335"
},
{
"name": "CVE-2026-58984",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58984"
},
{
"name": "CVE-2026-66113",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66113"
},
{
"name": "CVE-2026-58882",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58882"
},
{
"name": "CVE-2026-49912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49912"
},
{
"name": "CVE-2026-59016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59016"
},
{
"name": "CVE-2026-58961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58961"
},
{
"name": "CVE-2026-58836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58836"
},
{
"name": "CVE-2026-59046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59046"
},
{
"name": "CVE-2026-58821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58821"
},
{
"name": "CVE-2026-58966",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58966"
},
{
"name": "CVE-2026-65586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65586"
},
{
"name": "CVE-2026-25286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25286"
},
{
"name": "CVE-2026-20522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20522"
},
{
"name": "CVE-2026-58962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58962"
},
{
"name": "CVE-2026-58969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58969"
},
{
"name": "CVE-2026-55271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55271"
},
{
"name": "CVE-2026-57547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57547"
},
{
"name": "CVE-2026-55264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55264"
},
{
"name": "CVE-2026-58957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58957"
},
{
"name": "CVE-2026-59021",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59021"
},
{
"name": "CVE-2026-59002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59002"
},
{
"name": "CVE-2026-58857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58857"
},
{
"name": "CVE-2026-20553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20553"
},
{
"name": "CVE-2026-58829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58829"
},
{
"name": "CVE-2026-43284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43284"
},
{
"name": "CVE-2026-59012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59012"
},
{
"name": "CVE-2026-28632",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28632"
},
{
"name": "CVE-2026-65587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65587"
},
{
"name": "CVE-2026-55287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55287"
},
{
"name": "CVE-2026-20525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20525"
},
{
"name": "CVE-2026-58968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58968"
},
{
"name": "CVE-2026-58847",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58847"
},
{
"name": "CVE-2026-58979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58979"
},
{
"name": "CVE-2026-58885",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58885"
},
{
"name": "CVE-2026-59003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59003"
},
{
"name": "CVE-2026-58975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58975"
},
{
"name": "CVE-2026-65076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65076"
},
{
"name": "CVE-2026-55261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55261"
},
{
"name": "CVE-2026-49922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49922"
},
{
"name": "CVE-2026-59001",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59001"
},
{
"name": "CVE-2026-28621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28621"
},
{
"name": "CVE-2026-20555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20555"
},
{
"name": "CVE-2026-58875",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58875"
},
{
"name": "CVE-2026-58949",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58949"
},
{
"name": "CVE-2026-20562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20562"
},
{
"name": "CVE-2026-58944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58944"
},
{
"name": "CVE-2026-20524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20524"
},
{
"name": "CVE-2026-45514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45514"
},
{
"name": "CVE-2026-59010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59010"
},
{
"name": "CVE-2026-58825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58825"
},
{
"name": "CVE-2026-58985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58985"
},
{
"name": "CVE-2026-58964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58964"
},
{
"name": "CVE-2025-48600",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48600"
},
{
"name": "CVE-2026-20527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20527"
},
{
"name": "CVE-2025-22442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22442"
},
{
"name": "CVE-2026-58876",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58876"
},
{
"name": "CVE-2026-49923",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49923"
},
{
"name": "CVE-2026-58971",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58971"
},
{
"name": "CVE-2025-22436",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22436"
},
{
"name": "CVE-2026-59022",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59022"
},
{
"name": "CVE-2026-28586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28586"
},
{
"name": "CVE-2026-20563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20563"
},
{
"name": "CVE-2026-28665",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28665"
},
{
"name": "CVE-2026-59045",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59045"
},
{
"name": "CVE-2026-58995",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58995"
},
{
"name": "CVE-2026-59008",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59008"
},
{
"name": "CVE-2026-20589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20589"
},
{
"name": "CVE-2026-58951",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58951"
},
{
"name": "CVE-2026-58870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58870"
},
{
"name": "CVE-2026-58884",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58884"
},
{
"name": "CVE-2026-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43499"
},
{
"name": "CVE-2026-58945",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58945"
},
{
"name": "CVE-2026-58934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58934"
},
{
"name": "CVE-2026-59044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59044"
},
{
"name": "CVE-2026-20556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20556"
},
{
"name": "CVE-2026-58879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58879"
},
{
"name": "CVE-2026-55262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55262"
},
{
"name": "CVE-2026-23240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23240"
},
{
"name": "CVE-2026-45201",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45201"
},
{
"name": "CVE-2026-31533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31533"
},
{
"name": "CVE-2026-58936",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58936"
},
{
"name": "CVE-2026-58978",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58978"
},
{
"name": "CVE-2026-58853",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58853"
},
{
"name": "CVE-2026-58970",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58970"
},
{
"name": "CVE-2026-55289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55289"
},
{
"name": "CVE-2026-41155",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41155"
},
{
"name": "CVE-2026-46242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46242"
},
{
"name": "CVE-2026-58871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58871"
},
{
"name": "CVE-2025-38627",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38627"
},
{
"name": "CVE-2026-20586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20586"
},
{
"name": "CVE-2026-59031",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59031"
},
{
"name": "CVE-2026-58827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58827"
},
{
"name": "CVE-2026-58883",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58883"
},
{
"name": "CVE-2026-58817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58817"
},
{
"name": "CVE-2026-58933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58933"
},
{
"name": "CVE-2025-0647",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0647"
},
{
"name": "CVE-2026-15466",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15466"
},
{
"name": "CVE-2026-58814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58814"
},
{
"name": "CVE-2026-0053",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0053"
},
{
"name": "CVE-2026-20565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20565"
},
{
"name": "CVE-2026-57537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57537"
},
{
"name": "CVE-2026-45199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45199"
},
{
"name": "CVE-2026-49931",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49931"
},
{
"name": "CVE-2026-57554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57554"
},
{
"name": "CVE-2026-11891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11891"
},
{
"name": "CVE-2026-9040",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9040"
},
{
"name": "CVE-2026-58868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58868"
},
{
"name": "CVE-2026-58965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58965"
},
{
"name": "CVE-2026-28580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28580"
},
{
"name": "CVE-2026-58946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58946"
},
{
"name": "CVE-2026-25287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25287"
},
{
"name": "CVE-2026-45522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45522"
},
{
"name": "CVE-2026-20558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20558"
},
{
"name": "CVE-2026-20521",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20521"
},
{
"name": "CVE-2026-58866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58866"
},
{
"name": "CVE-2026-58974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58974"
},
{
"name": "CVE-2026-64427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64427"
},
{
"name": "CVE-2026-58867",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58867"
},
{
"name": "CVE-2026-58963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58963"
},
{
"name": "CVE-2026-16280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16280"
},
{
"name": "CVE-2025-22426",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22426"
},
{
"name": "CVE-2026-20499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20499"
},
{
"name": "CVE-2026-20549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20549"
},
{
"name": "CVE-2026-59028",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59028"
},
{
"name": "CVE-2026-57546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57546"
},
{
"name": "CVE-2026-23184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23184"
},
{
"name": "CVE-2026-58976",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58976"
},
{
"name": "CVE-2026-20561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20561"
},
{
"name": "CVE-2026-6726",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6726"
},
{
"name": "CVE-2026-55292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55292"
},
{
"name": "CVE-2026-58989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58989"
},
{
"name": "CVE-2026-20564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20564"
},
{
"name": "CVE-2026-57545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57545"
},
{
"name": "CVE-2026-58994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58994"
},
{
"name": "CVE-2026-58828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58828"
},
{
"name": "CVE-2026-59006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59006"
},
{
"name": "CVE-2026-58988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58988"
},
{
"name": "CVE-2026-20545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20545"
},
{
"name": "CVE-2026-28645",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28645"
},
{
"name": "CVE-2026-25301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25301"
},
{
"name": "CVE-2026-58986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58986"
},
{
"name": "CVE-2026-58955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58955"
},
{
"name": "CVE-2026-18629",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18629"
},
{
"name": "CVE-2026-58844",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58844"
},
{
"name": "CVE-2026-20559",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20559"
},
{
"name": "CVE-2026-28597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28597"
},
{
"name": "CVE-2026-59015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59015"
},
{
"name": "CVE-2026-59043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59043"
},
{
"name": "CVE-2026-57549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57549"
},
{
"name": "CVE-2026-49924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49924"
},
{
"name": "CVE-2026-20560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20560"
},
{
"name": "CVE-2026-49935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49935"
},
{
"name": "CVE-2026-59004",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59004"
},
{
"name": "CVE-2026-20526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20526"
},
{
"name": "CVE-2026-53256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53256"
},
{
"name": "CVE-2026-58837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58837"
},
{
"name": "CVE-2026-19199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19199"
},
{
"name": "CVE-2026-59005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59005"
},
{
"name": "CVE-2026-58953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58953"
},
{
"name": "CVE-2026-55272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55272"
},
{
"name": "CVE-2026-20547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20547"
},
{
"name": "CVE-2026-58997",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58997"
},
{
"name": "CVE-2026-45204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45204"
},
{
"name": "CVE-2026-74912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74912"
},
{
"name": "CVE-2026-25302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25302"
},
{
"name": "CVE-2026-59047",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59047"
},
{
"name": "CVE-2026-59042",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59042"
},
{
"name": "CVE-2026-58942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58942"
},
{
"name": "CVE-2026-28643",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28643"
},
{
"name": "CVE-2025-26433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26433"
},
{
"name": "CVE-2026-59011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59011"
},
{
"name": "CVE-2026-59000",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59000"
},
{
"name": "CVE-2026-79405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79405"
},
{
"name": "CVE-2026-58937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58937"
},
{
"name": "CVE-2026-58956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58956"
},
{
"name": "CVE-2026-58845",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58845"
},
{
"name": "CVE-2026-20520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20520"
},
{
"name": "CVE-2026-25285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25285"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-28588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28588"
},
{
"name": "CVE-2026-59014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59014"
},
{
"name": "CVE-2026-25291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25291"
},
{
"name": "CVE-2026-55283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55283"
},
{
"name": "CVE-2026-58938",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58938"
},
{
"name": "CVE-2026-66086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66086"
},
{
"name": "CVE-2026-59007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59007"
},
{
"name": "CVE-2026-80336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80336"
},
{
"name": "CVE-2026-20519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20519"
},
{
"name": "CVE-2026-66114",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66114"
},
{
"name": "CVE-2026-20523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20523"
},
{
"name": "CVE-2026-58877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58877"
},
{
"name": "CVE-2026-59048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59048"
},
{
"name": "CVE-2026-58824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58824"
},
{
"name": "CVE-2026-22165",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22165"
},
{
"name": "CVE-2026-89774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89774"
},
{
"name": "CVE-2026-58838",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58838"
},
{
"name": "CVE-2026-58826",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58826"
},
{
"name": "CVE-2025-22424",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22424"
},
{
"name": "CVE-2026-46232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46232"
},
{
"name": "CVE-2026-49934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49934"
},
{
"name": "CVE-2026-55263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55263"
},
{
"name": "CVE-2026-20554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20554"
},
{
"name": "CVE-2026-20557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20557"
},
{
"name": "CVE-2026-80604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80604"
},
{
"name": "CVE-2026-64011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64011"
},
{
"name": "CVE-2026-55288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55288"
},
{
"name": "CVE-2026-57548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57548"
},
{
"name": "CVE-2026-59020",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59020"
},
{
"name": "CVE-2026-55257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55257"
}
],
"initial_release_date": "2026-11-03T00:00:00",
"last_revision_date": "2026-11-03T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1443",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-11-03T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": "2026-11-02",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01?hl=fr"
}
]
}
CVE-2026-58977 (GCVE-0-2026-58977)
Vulnerability from nvd – Published: 2026-11-02 20:26 – Updated: 2026-11-02 20:26
VLAI
EPSS
VEX
Summary
In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:26:00.147Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/wear/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58977",
"datePublished": "2026-11-02T20:26:00.147Z",
"dateReserved": "2026-07-02T06:19:18.137Z",
"dateUpdated": "2026-11-02T20:26:00.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58930 (GCVE-0-2026-58930)
Vulnerability from nvd – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An unprivileged application can exploit a lack of package/signature validation in SystemUI\u0027s `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:14.949Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58930",
"datePublished": "2026-11-02T20:21:14.949Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:14.949Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58927 (GCVE-0-2026-58927)
Vulnerability from nvd – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object's vtable at `cameraObj->getCameraInfo(&desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object\u0027s vtable at `cameraObj-\u003egetCameraInfo(\u0026desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:13.927Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58927",
"datePublished": "2026-11-02T20:21:13.927Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:13.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58926 (GCVE-0-2026-58926)
Vulnerability from nvd – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.
Severity
No CVSS data available.
CWE
- Information disclosure
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:12.920Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58926",
"datePublished": "2026-11-02T20:21:12.920Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:12.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58925 (GCVE-0-2026-58925)
Vulnerability from nvd – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:11.897Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58925",
"datePublished": "2026-11-02T20:21:11.897Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:11.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58924 (GCVE-0-2026-58924)
Vulnerability from nvd – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.
Severity
No CVSS data available.
CWE
- Information disclosure
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The vulnerability is a heap out-of-bounds read in the EVS HAL\u0027s `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process\u0027s heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:10.883Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58924",
"datePublished": "2026-11-02T20:21:10.883Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:10.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58915 (GCVE-0-2026-58915)
Vulnerability from nvd – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver\u0027s unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:09.862Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58915",
"datePublished": "2026-11-02T20:21:09.862Z",
"dateReserved": "2026-07-02T06:11:33.330Z",
"dateUpdated": "2026-11-02T20:21:09.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58873 (GCVE-0-2026-58873)
Vulnerability from nvd – Published: 2026-11-02 20:31 – Updated: 2026-11-02 21:15
VLAI
EPSS
VEX
Summary
In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 21:15 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://source.android.com/docs/security/bulletin… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Android XR |
Affected:
14
|
Date Public
2026-11-02 20:29
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-58873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T21:15:22.910720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T21:15:26.209Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "XR",
"platforms": [
"Android"
],
"product": "Android XR",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "14"
}
]
}
],
"datePublic": "2026-11-02T20:29:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"value": "In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:31:02.552Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://source.android.com/docs/security/bulletin/xr/2026/2026-11-01"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58873",
"datePublished": "2026-11-02T20:31:02.552Z",
"dateReserved": "2026-07-02T06:02:21.466Z",
"dateUpdated": "2026-11-02T21:15:26.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49906 (GCVE-0-2026-49906)
Vulnerability from nvd – Published: 2026-11-02 20:21 – Updated: 2026-11-03 04:56
VLAI
EPSS
VEX
Summary
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 00:00 UTC
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49906",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T04:56:25.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:08.851Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-49906",
"datePublished": "2026-11-02T20:21:08.851Z",
"dateReserved": "2026-06-02T14:40:11.937Z",
"dateUpdated": "2026-11-03T04:56:25.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49903 (GCVE-0-2026-49903)
Vulnerability from nvd – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:07.826Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-49903",
"datePublished": "2026-11-02T20:21:07.826Z",
"dateReserved": "2026-06-02T14:40:11.937Z",
"dateUpdated": "2026-11-02T20:21:07.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59048 (GCVE-0-2026-59048)
Vulnerability from nvd – Published: 2026-11-02 19:55 – Updated: 2026-11-02 19:55
VLAI
EPSS
VEX
Summary
In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
CWE
- Information disclosure
Assigner
References
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "Android kernel"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:55:14.970Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e"
},
{
"url": "https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea"
},
{
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-59048",
"datePublished": "2026-11-02T19:55:14.970Z",
"dateReserved": "2026-07-02T06:28:02.376Z",
"dateUpdated": "2026-11-02T19:55:14.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59047 (GCVE-0-2026-59047)
Vulnerability from nvd – Published: 2026-11-02 19:55 – Updated: 2026-11-02 19:55
VLAI
EPSS
VEX
Summary
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
CWE
- Denial of service
Assigner
References
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "Android kernel"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of service",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:55:13.919Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/kernel/common/+/ba356506706b7bd953c501ea91ee7c0d55c1ad83"
},
{
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-59047",
"datePublished": "2026-11-02T19:55:13.919Z",
"dateReserved": "2026-07-02T06:28:02.376Z",
"dateUpdated": "2026-11-02T19:55:13.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59046 (GCVE-0-2026-59046)
Vulnerability from nvd – Published: 2026-11-02 19:55 – Updated: 2026-11-02 19:55
VLAI
EPSS
VEX
Summary
In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
CWE
- Denial of service
Assigner
References
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "Android kernel"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of service",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:55:12.892Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/kernel/common/+/4a75aa4e840f294efd47084e083a6e91069bce58"
},
{
"url": "https://android.googlesource.com/kernel/common/+/525cfccadb92e7c9314d03cce600fed7335874d9"
},
{
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-59046",
"datePublished": "2026-11-02T19:55:12.892Z",
"dateReserved": "2026-07-02T06:28:02.376Z",
"dateUpdated": "2026-11-02T19:55:12.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59045 (GCVE-0-2026-59045)
Vulnerability from nvd – Published: 2026-11-02 19:55 – Updated: 2026-11-02 19:55
VLAI
EPSS
VEX
Summary
In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
12 references
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "Android kernel"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:55:11.873Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5"
},
{
"url": "https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15"
},
{
"url": "https://android.googlesource.com/kernel/common/+/eb970aae88c0f45056f4501b7815a9b5c7ab0435"
},
{
"url": "https://android.googlesource.com/kernel/common/+/f6510cfbc728061d7a8d4ea4ac91e5fc270aaf6b"
},
{
"url": "https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3"
},
{
"url": "https://android.googlesource.com/kernel/common/+/22ae719f35b14f88e551f0e858a1087a4b721204"
},
{
"url": "https://android.googlesource.com/kernel/common/+/bd9aaec66cf50ea3ade2b537d9b730e40fe512e6"
},
{
"url": "https://android.googlesource.com/kernel/common/+/f89e83e20aa69fbdd5b2f2de284dafcaadbda7c7"
},
{
"url": "https://android.googlesource.com/kernel/common/+/acce19149cb8ebe92218d0e66c08bc36552ddbdf"
},
{
"url": "https://android.googlesource.com/kernel/common/+/e10fb80c80387aa1f26695b57df95afe0ef00481"
},
{
"url": "https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24"
},
{
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-59045",
"datePublished": "2026-11-02T19:55:11.873Z",
"dateReserved": "2026-07-02T06:28:02.376Z",
"dateUpdated": "2026-11-02T19:55:11.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59044 (GCVE-0-2026-59044)
Vulnerability from nvd – Published: 2026-11-02 19:55 – Updated: 2026-11-03 04:56
VLAI
EPSS
VEX
Summary
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 00:00 UTC
CWE
- Elevation of privilege
- CWE-416 - Use After Free
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-59044",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T04:56:35.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "Android kernel"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:55:10.869Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5"
},
{
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-59044",
"datePublished": "2026-11-02T19:55:10.869Z",
"dateReserved": "2026-07-02T06:28:02.376Z",
"dateUpdated": "2026-11-03T04:56:35.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59043 (GCVE-0-2026-59043)
Vulnerability from nvd – Published: 2026-11-02 19:55 – Updated: 2026-11-03 04:56
VLAI
EPSS
VEX
Summary
In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 00:00 UTC
CWE
- Elevation of privilege
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59043",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T04:56:47.434Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "Android kernel"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:55:09.866Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7"
},
{
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-59043",
"datePublished": "2026-11-02T19:55:09.866Z",
"dateReserved": "2026-07-02T06:26:54.658Z",
"dateUpdated": "2026-11-03T04:56:47.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59042 (GCVE-0-2026-59042)
Vulnerability from nvd – Published: 2026-11-02 19:55 – Updated: 2026-11-03 04:56
VLAI
EPSS
VEX
Summary
In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 00:00 UTC
CWE
- Elevation of privilege
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59042",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T04:56:46.698Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "Android kernel"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:55:08.840Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715"
},
{
"url": "https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e"
},
{
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-59042",
"datePublished": "2026-11-02T19:55:08.840Z",
"dateReserved": "2026-07-02T06:26:54.658Z",
"dateUpdated": "2026-11-03T04:56:46.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59031 (GCVE-0-2026-59031)
Vulnerability from nvd – Published: 2026-11-02 19:55 – Updated: 2026-11-02 19:55
VLAI
EPSS
VEX
Summary
In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
CWE
- Denial of service
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of service",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:55:07.835Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-59031",
"datePublished": "2026-11-02T19:55:07.835Z",
"dateReserved": "2026-07-02T06:25:39.898Z",
"dateUpdated": "2026-11-02T19:55:07.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59028 (GCVE-0-2026-59028)
Vulnerability from nvd – Published: 2026-11-02 19:55 – Updated: 2026-11-03 04:56
VLAI
EPSS
VEX
Summary
In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 00:00 UTC
CWE
- Elevation of privilege
- CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-59028",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441 Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T04:56:27.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:55:06.818Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-59028",
"datePublished": "2026-11-02T19:55:06.818Z",
"dateReserved": "2026-07-02T06:25:39.897Z",
"dateUpdated": "2026-11-03T04:56:27.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58873 (GCVE-0-2026-58873)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:31 – Updated: 2026-11-02 21:15
VLAI
EPSS
VEX
Summary
In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 21:15 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://source.android.com/docs/security/bulletin… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Android XR |
Affected:
14
|
Date Public
2026-11-02 20:29
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-58873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T21:15:22.910720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T21:15:26.209Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "XR",
"platforms": [
"Android"
],
"product": "Android XR",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "14"
}
]
}
],
"datePublic": "2026-11-02T20:29:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"value": "In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:31:02.552Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://source.android.com/docs/security/bulletin/xr/2026/2026-11-01"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58873",
"datePublished": "2026-11-02T20:31:02.552Z",
"dateReserved": "2026-07-02T06:02:21.466Z",
"dateUpdated": "2026-11-02T21:15:26.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58977 (GCVE-0-2026-58977)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:26 – Updated: 2026-11-02 20:26
VLAI
EPSS
VEX
Summary
In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:26:00.147Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/wear/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58977",
"datePublished": "2026-11-02T20:26:00.147Z",
"dateReserved": "2026-07-02T06:19:18.137Z",
"dateUpdated": "2026-11-02T20:26:00.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58930 (GCVE-0-2026-58930)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An unprivileged application can exploit a lack of package/signature validation in SystemUI\u0027s `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:14.949Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58930",
"datePublished": "2026-11-02T20:21:14.949Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:14.949Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58927 (GCVE-0-2026-58927)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object's vtable at `cameraObj->getCameraInfo(&desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object\u0027s vtable at `cameraObj-\u003egetCameraInfo(\u0026desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:13.927Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58927",
"datePublished": "2026-11-02T20:21:13.927Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:13.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58926 (GCVE-0-2026-58926)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.
Severity
No CVSS data available.
CWE
- Information disclosure
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:12.920Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58926",
"datePublished": "2026-11-02T20:21:12.920Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:12.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58925 (GCVE-0-2026-58925)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:11.897Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58925",
"datePublished": "2026-11-02T20:21:11.897Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:11.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58924 (GCVE-0-2026-58924)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.
Severity
No CVSS data available.
CWE
- Information disclosure
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The vulnerability is a heap out-of-bounds read in the EVS HAL\u0027s `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process\u0027s heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:10.883Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58924",
"datePublished": "2026-11-02T20:21:10.883Z",
"dateReserved": "2026-07-02T06:12:52.307Z",
"dateUpdated": "2026-11-02T20:21:10.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58915 (GCVE-0-2026-58915)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver\u0027s unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:09.862Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-58915",
"datePublished": "2026-11-02T20:21:09.862Z",
"dateReserved": "2026-07-02T06:11:33.330Z",
"dateUpdated": "2026-11-02T20:21:09.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49906 (GCVE-0-2026-49906)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:21 – Updated: 2026-11-03 04:56
VLAI
EPSS
VEX
Summary
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 00:00 UTC
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49906",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T04:56:25.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:08.851Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-49906",
"datePublished": "2026-11-02T20:21:08.851Z",
"dateReserved": "2026-06-02T14:40:11.937Z",
"dateUpdated": "2026-11-03T04:56:25.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49903 (GCVE-0-2026-49903)
Vulnerability from cvelistv5 – Published: 2026-11-02 20:21 – Updated: 2026-11-02 20:21
VLAI
EPSS
VEX
Summary
The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.
Severity
No CVSS data available.
CWE
- Elevation of privilege
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "17"
},
{
"status": "affected",
"version": "16-qpr2"
},
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T20:21:07.826Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2026-49903",
"datePublished": "2026-11-02T20:21:07.826Z",
"dateReserved": "2026-06-02T14:40:11.937Z",
"dateUpdated": "2026-11-02T20:21:07.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}