{"id":"CVE-2026-58957","published":"2026-11-02T20:17:52.280","lastModified":"2026-11-03T05:18:49.677","description":"In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability in Android's ActivityStarter allows a local attacker to trigger a background activity launch without user interaction, leading to full local privilege escalation (confidentiality, integrity, and availability impact) by bypassing expected access controls.","exploitability":"Exploitation requires local access and no additional privileges; user interaction is not needed, making it highly exploitable in compromised or physically proximate scenarios.","blast_radius":"Successful exploitation grants an unprivileged local attacker full control over the device, enabling persistent compromise, data theft, and system manipulation without detection by standard user-facing protections.","remediation":"Apply the official patch released in Android Security Bulletin 2026-12 (or later), which specifically addresses CVE-2026-58957 in ActivityStarter.java; if no bulletin or fixed version is published, disable background activity launches via the confused deputy code path until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["confused-deputy","privilege-escalation","android","local-exploit","no-ui-required"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:06:30.877Z"}}