CVE Watch3 de nov. de 2026

CVE-2026-55257

In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local

CVSS

8.4

Alta

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 2 de nov. de 2026 · Última mod.: 3 de nov. de 2026 · CWE-451

EPSS · 30d

0.1%EPSS · 30 dias0.1%

2026-11-032026-11-07

Descrição técnica

In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Referências oficiais

source.android.comhttps://source.android.com/docs/security/bulletin/2026/2026-11-01

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1239954.6 MÉD

2.8%

——1Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.1d CVE-2026-1212445.4 MÉD

9.7%

——3UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)3d CVE-2026-1212165.4 MÉD

9.7%

——3UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)3d CVE-2026-1212155.4 MÉD

9.1%

——3UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)3d CVE-2026-121209—

8.1%

——2UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)4d CVE-2026-1212065.4 MÉD

9.7%

——3UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)3d