Google Android CVE-2026-58679

Requires the attacker to already have local code execution on the device as an unprivileged app (PR:N here means no elevated privileges are needed, but on-device execution is required - AV:L). The vulnerable code path is gf_ta_test_set_config in gf_ta_test.c, apparently a fingerprint/trusted-application test/config routine, so reaching it depends on that component being present and callable in the target build (Pixel/Android per the September 2026 Pixel bulletin). No user interaction is needed (UI:N). Limiting factors: exploitation cannot be performed remotely or over the network, and the attacker must first get a malicious app onto the device; there is no known public exploit, and the bug is fixed in the 2026-09-01 Pixel security patch level.

Signals are internally consistent but point to a moderate, not critical, real-world priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, vendor base 8.4) describes a locally-exploitable heap buffer overflow reachable by an unprivileged app with no user interaction - a clean local privilege-escalation shape typical of Android/Pixel monthly-bulletin memory-corruption bugs. EPSS is very low at 0.12% (2nd percentile), there is no CISA KEV listing and no public POC identified, so this is no public exploit identified at time of analysis and not evidence of active or widespread exploitation. The C:H/I:H/A:H triad is generous vendor boilerplate: a heap overflow in a fingerprint/TA config path can plausibly yield code execution in the target context, but the description only substantiates 'local escalation of privilege,' not confirmed full confidentiality/integrity/availability compromise. No signals conflict - the local attack vector, absence of exploitation evidence, and low EPSS all align on 'patch on the normal Android security-update cadence' rather than emergency response. Note SSVC data was not provided in the input, so the SSVC framework cannot be applied here.

A user is convinced to install a malicious or trojanized app from outside the Play Store (or a low-privilege app already on the device is co-opted). The app issues a crafted request to the vulnerable gf_ta_test_set_config path, triggering the heap buffer overflow to corrupt memory and elevate its privileges without any user interaction. No public exploit code is known, and exploitation requires local code execution on the device first.