CVE-2026-58957

Summary

A confused deputy vulnerability in Android's ActivityStarter allows a local attacker to trigger a background activity launch without user interaction, leading to full local privilege escalation (confidentiality, integrity, and availability impact) by bypassing expected access controls.

Exploitability

Exploitation requires local access and no additional privileges; user interaction is not needed, making it highly exploitable in compromised or physically proximate scenarios.

Blast radius

Successful exploitation grants an unprivileged local attacker full control over the device, enabling persistent compromise, data theft, and system manipulation without detection by standard user-facing protections.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the official patch released in Android Security Bulletin 2026-12 (or later), which specifically addresses CVE-2026-58957 in ActivityStarter.java; if no bulletin or fixed version is published, disable background activity launches via the confused deputy code path until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.