CVE-2026-58873

Summary

A missing permission check in WindowManagerService's addDragDropListener allows unprivileged local processes to bypass Android's drag-and-drop permission enforcement, enabling full local privilege escalation without user interaction.

Exploitability

Exploitation requires local code execution as an unprivileged app with no additional privileges or user interaction; the flaw is trivially exploitable once such access is obtained.

Blast radius

Successful exploitation grants full local elevation of privilege (C:H/I:H/A:H), allowing attackers to read sensitive data, modify system state, and execute arbitrary code with system-level permissions on affected devices.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the official patch released in Android Security Bulletin 2026-12 (patch level 2026-12-05 or later) that adds the required permission check in WindowManagerService.addDragDropListener.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.