{"id":"CVE-2026-55271","published":"2026-11-02T20:17:44.563","lastModified":"2026-11-03T05:18:44.363","description":"In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The ContactsPickerActivity in Android's Contacts app has a confused deputy vulnerability (CWE-441) that allows local privilege escalation by redirecting an internal intent to an unintended target without user interaction.","exploitability":"Exploitation requires local access and no user interaction, but the attacker must already have code execution or be able to craft a malicious intent from a trusted context.","blast_radius":"Successful exploitation could allow an unprivileged local attacker to read, modify, or delete contacts data, or trigger privileged operations on behalf of the Contacts app.","remediation":"Upgrade to Android 15 Security Patch Level 2026-07 or later, as this is the earliest known fixed version for CVE-2026-55271.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["intent-redirection","confused-deputy","privilege-escalation","android","local"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:03:47.789Z"}}