{"id":"CVE-2026-55287","published":"2026-11-02T20:17:45.017","lastModified":"2026-11-03T05:18:44.890","description":"In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-451"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A misleading UI in GrantCredentialsPermissionActivity allows an attacker to trick the user into granting account credentials without requiring user interaction, enabling local privilege escalation.","exploitability":"Exploitation requires local access and no additional privileges, but user interaction is not needed, making it highly exploitable by a local attacker.","blast_radius":"Successful exploitation grants full local system compromise (confidentiality, integrity, availability) with no network or remote dependencies.","remediation":"Patch to the fixed version specified in the official advisory; if none is published, disable or restrict access to GrantCredentialsPermissionActivity until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ui-spoofing","privilege-escalation","local-exploit","cwe-451"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:04:12.785Z"}}