{"id":"CVE-2026-58884","published":"2026-11-02T20:17:50.280","lastModified":"2026-11-03T05:18:47.973","description":"In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability in WifiServiceImpl.java allows a local unprivileged process to bypass permission checks and start a tethered hotspot, leading to full local privilege escalation without user interaction.","exploitability":"Exploitation requires local access and no additional privileges; it is straightforward for an attacker with a compromised or malicious local app.","blast_radius":"Successful exploitation grants the attacker full control over the device's Wi-Fi tethering functionality, potentially enabling data exfiltration, network interception, or further lateral movement within the system.","remediation":"Upgrade to Android version with patch level 2026-11 or later, as patched in the official Android Security Bulletin for November 2026 (CVE-2026-58884).","detection":"Monitor for unexpected calls to startTetheredHotspotRequest from non-system processes in system_server logs; specifically, look for binder calls originating from UID 0 or non-privileged UIDs without the required CONNECTIVITY_INTERNAL permission.","tags":["confused-deputy","privilege-escalation","android","wifi","permission-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:05:30.200Z"}}