CVE Watch3 de nov. de 2026

CVE-2026-49906

An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `a

CVSS

7.8

Alta

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 2 de nov. de 2026 · Última mod.: 3 de nov. de 2026 · CWE-441

EPSS · 30d

0.1%EPSS · 30 dias0.2%

2026-11-032026-11-06

Descrição técnica

An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.

Referências oficiais

source.android.comhttps://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-889835.0 MÉD

9.8%

——3Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.1d CVE-2026-1211988.8 ALT

12.1%

——4Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)1d CVE-2026-1211718.8 ALT

15.4%

——5Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)11h CVE-2026-1211088.8 ALT

17.7%

——5Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)1d CVE-2026-499035.3 MÉD

3.7%

——1The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.9h CVE-2026-590288.4 ALT

0.7%

——0In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.2d