IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.3Orta

CVE-2026-49903

Google Android Yayım: (7 gün önce)

Açıklama

The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.

Zayıflık türü (CWE): CWE-441

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Google Android 17, 16-qpr2, 16, 15, 14

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (5)
  • cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*
  • cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*
  • cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*

Aynı üründe son açıklar — Android

6.7Orta
CVE-2026-58977
Google Android

In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

7.8Yüksek
CVE-2026-58930
Google Android

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, injec…

6.7Orta
CVE-2026-58927
Google Android

The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a …

2.5Düşük
CVE-2026-58926
Google Android

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacke…

7.8Yüksek
CVE-2026-58925
Google Android

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigg…

7.5Yüksek
CVE-2026-58924
Google Android

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within th…