{"id":"CVE-2026-59028","published":"2026-11-02T20:17:57.257","lastModified":"2026-11-03T05:18:50.763","description":"In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-441"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A confused deputy vulnerability in resolveAidConflictLocked allows an unprivileged local process to bypass Android's permission checks and gain full read/write/execute access to protected NFC AID resources without user interaction or elevated privileges.","exploitability":"Exploitation requires local code execution as an unprivileged app; no additional privileges or user interaction are needed, making it highly exploitable on compromised or rooted devices.","blast_radius":"Successful exploitation grants full local privilege escalation, enabling attackers to impersonate NFC payment or access control services, potentially leading to financial fraud or physical access bypass.","remediation":"Apply the patch released in Android Security Bulletin 2026-12 (patch level 2026-12-05) or later, which fixes the confused deputy issue by validating caller permissions before resolving AID conflicts.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["confused-deputy","privilege-escalation","nfc","android","local-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:07:15.984Z"}}