{"id":"CVE-2026-58965","published":"2026-11-02T20:17:52.807","lastModified":"2026-11-03T05:18:49.913","description":"In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability in handleAudioEffectBroadcast allows an unprivileged local process to bypass permission checks and gain full local privilege escalation (confidentiality, integrity, availability) without user interaction.","exploitability":"Exploitation is straightforward for a local attacker with no additional privileges or user interaction required, leveraging the confused deputy pattern to abuse internal broadcast handling.","blast_radius":"Successful exploitation grants full control over the affected service or device, enabling data theft, system modification, or denial of service by any local unprivileged process.","remediation":"Apply the vendor patch for CVE-2026-58965 when released; until then, restrict access to the handleAudioEffectBroadcast endpoint by enforcing strict permission checks in MusicFxHelper.java and disabling non-essential audio effect broadcasting features.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["permission-bypass","confused-deputy","privilege-escalation","local-exploit","no-ui"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:06:40.858Z"}}