CVE-2026-49931

Summary

A confused deputy vulnerability in Android's onActivityResult allows an untrusted app to bypass contact access protections and leak protected profile information without user interaction.

Exploitability

Local exploitation requires the attacker to already have a compromised or malicious app installed with no additional privileges; no user interaction is needed.

Blast radius

Successful exploitation could allow a local attacker to access sensitive contact data from protected profiles, enabling identity theft or further privilege escalation within the device.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the Android security patch released in the July 2026 Monthly Release (or later), which specifically addresses this confused deputy issue in onActivityResult handlers.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.