CVE-2026-58866

Summary

A missing permission check in AccessibilityWindowManager.java allows an attacker to set accessibility window attributes without authorization, potentially misleading the user interface and enabling local privilege escalation.

Exploitability

Exploitation requires local access and no user interaction; the missing permission check makes it straightforward for a local attacker.

Blast radius

Successful exploitation could allow an attacker to manipulate system UI elements (e.g., overlay windows, focus) to steal credentials or execute unauthorized actions with elevated privileges.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Add a permission check in setAccessibilityWindowAttributes() to enforce the required system-level permission before allowing modification of accessibility window attributes; if a fixed version is available, upgrade to the patched release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.