{"id":"CVE-2026-59000","published":"2026-11-02T20:17:55.057","lastModified":"2026-11-03T05:18:50.550","description":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability allows an unprivileged local attacker to bypass permission checks by tricking a privileged component into performing unauthorized actions on its behalf, leading to full local privilege escalation without user interaction.","exploitability":"Exploitation requires local access and no additional privileges; it is straightforward for an attacker already present in the system due to the low complexity (AC:L) and no user interaction needed.","blast_radius":"Successful exploitation grants full local compromise of confidentiality, integrity, and availability on the affected host, enabling complete system takeover by a local attacker.","remediation":"Upgrade to the patched version specified by the vendor; since no fixed version is named in the description, apply the principle of least privilege, audit and restrict access to the vulnerable component, and disable the affected feature until a patch is applied.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["confused-deputy","privilege-escalation","local-exploit","permission-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:07:07.538Z"}}