CVE-2026-55287

Summary

A misleading UI in GrantCredentialsPermissionActivity allows an attacker to trick the user into granting account credentials without requiring user interaction, enabling local privilege escalation.

Exploitability

Exploitation requires local access and no additional privileges, but user interaction is not needed, making it highly exploitable by a local attacker.

Blast radius

Successful exploitation grants full local system compromise (confidentiality, integrity, availability) with no network or remote dependencies.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Patch to the fixed version specified in the official advisory; if none is published, disable or restrict access to GrantCredentialsPermissionActivity until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.