CVE-2026-59028

Summary

A confused deputy vulnerability in resolveAidConflictLocked allows an unprivileged local process to bypass Android's permission checks and gain full read/write/execute access to protected NFC AID resources without user interaction or elevated privileges.

Exploitability

Exploitation requires local code execution as an unprivileged app; no additional privileges or user interaction are needed, making it highly exploitable on compromised or rooted devices.

Blast radius

Successful exploitation grants full local privilege escalation, enabling attackers to impersonate NFC payment or access control services, potentially leading to financial fraud or physical access bypass.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the patch released in Android Security Bulletin 2026-12 (patch level 2026-12-05) or later, which fixes the confused deputy issue by validating caller permissions before resolving AID conflicts.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.