CVE-2026-58884

Summary

A confused deputy vulnerability in WifiServiceImpl.java allows a local unprivileged process to bypass permission checks and start a tethered hotspot, leading to full local privilege escalation without user interaction.

Exploitability

Exploitation requires local access and no additional privileges; it is straightforward for an attacker with a compromised or malicious local app.

Blast radius

Successful exploitation grants the attacker full control over the device's Wi-Fi tethering functionality, potentially enabling data exfiltration, network interception, or further lateral movement within the system.

Detection

Monitor for unexpected calls to startTetheredHotspotRequest from non-system processes in system_server logs; specifically, look for binder calls originating from UID 0 or non-privileged UIDs without the required CONNECTIVITY_INTERNAL permission.

Prioritized remediation

Upgrade to Android version with patch level 2026-11 or later, as patched in the official Android Security Bulletin for November 2026 (CVE-2026-58884).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.