{"id":"CVE-2026-58873","published":"2026-11-02T21:17:35.373","lastModified":"2026-11-02T22:17:21.960","description":"In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/xr/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A missing permission check in WindowManagerService's addDragDropListener allows unprivileged local processes to bypass Android's drag-and-drop permission enforcement, enabling full local privilege escalation without user interaction.","exploitability":"Exploitation requires local code execution as an unprivileged app with no additional privileges or user interaction; the flaw is trivially exploitable once such access is obtained.","blast_radius":"Successful exploitation grants full local elevation of privilege (C:H/I:H/A:H), allowing attackers to read sensitive data, modify system state, and execute arbitrary code with system-level permissions on affected devices.","remediation":"Apply the official patch released in Android Security Bulletin 2026-12 (patch level 2026-12-05 or later) that adds the required permission check in WindowManagerService.addDragDropListener.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","permission-bypass","android","local-exploit","cwe862"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:07:35.336Z"}}