{"id":"CVE-2026-58934","published":"2026-11-02T20:17:50.720","lastModified":"2026-11-03T05:18:48.543","description":"In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-693"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A logic error in WindowState.java's prepareWindowToDisplayDuringRelayout method allows a local attacker to bypass permission checks when displaying windows, enabling escalation of privilege without user interaction or additional privileges.","exploitability":"Exploitation requires local access and no additional privileges; the flaw is triggered programmatically during window layout operations, making it exploitable by a malicious app or compromised process with basic Android runtime access.","blast_radius":"Successful exploitation could allow an unprivileged local process to gain full system-level access, compromising confidentiality, integrity, and availability of the entire device.","remediation":"Apply the official patch released in Android Security Bulletin 2026-07 (or later), specifically addressing WindowState.java logic in prepareWindowToDisplayDuringRelayout; if no bulletin or version is published, disable window relayout features for untrusted apps via device policy or SELinux policy restrictions.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","permission-bypass","android","logic-flaw","local-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:05:46.894Z"}}