{"id":"CVE-2026-55262","published":"2026-11-02T20:17:44.217","lastModified":"2026-11-03T05:18:44.183","description":"In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible  policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a policy desynchronization in NotificationManagerService.java caused by insufficient input validation when setting notification listener access for a user, allowing an unprivileged local attacker to bypass intended restrictions and gain elevated privileges without user interaction.","exploitability":"Exploitation requires local access and no additional privileges, but the exact trigger condition is not specified, making reliable exploitation difficult without deeper knowledge of internal state transitions.","blast_radius":"Successful exploitation could allow a local attacker to fully compromise the device—reading sensitive data, modifying system behavior, and crashing services—without requiring user interaction or elevated credentials.","remediation":"Apply the official patch released in Android Security Bulletin 2026-10 (patch level 2026-10-05) or later, which addresses the input validation issue in NotificationManagerService.setNotificationListenerAccessGrantedForUserInternal().","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","input-validation","android","local-exploit","policy-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:03:37.580Z"}}