{"id":"CVE-2026-49931","published":"2026-11-02T20:17:43.170","lastModified":"2026-11-03T05:18:43.810","description":"In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability in Android's onActivityResult allows an untrusted app to bypass contact access protections and leak protected profile information without user interaction.","exploitability":"Local exploitation requires the attacker to already have a compromised or malicious app installed with no additional privileges; no user interaction is needed.","blast_radius":"Successful exploitation could allow a local attacker to access sensitive contact data from protected profiles, enabling identity theft or further privilege escalation within the device.","remediation":"Apply the Android security patch released in the July 2026 Monthly Release (or later), which specifically addresses this confused deputy issue in onActivityResult handlers.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["confused-deputy","privilege-escalation","contact-leak","android","local-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:03:18.283Z"}}