Google Android CVE-2026-58837

Exploitation requires local presence on the device - the attacker must already be able to run code, which in the Android model means a malicious or compromised app installed on the handset (AV:L). Per the CVSS vector no elevated privileges (PR:N) and no user interaction (UI:N) are needed once that app is running, and the description states no additional execution privileges are needed and user interaction is not required. The limiting factors are therefore: no remote/network reachability (the attacker cannot trigger this over the network), and the need to get code onto the device first; realistic risk is scoped to scenarios where a hostile app is already installed. The specific vulnerable component/feature is not named by the vendor ('multiple locations'), so no configuration-specific precondition can be confirmed from the available sources.

Signals are moderately consistent but point to a serious-yet-not-emergency local flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.4 High) describes a local, low-complexity escalation with total impact to confidentiality, integrity and availability, which aligns with the description of a logic error enabling unauthorized background activity launch leading to local privilege escalation. The SSVC framework corroborates severity on impact (Technical Impact: total) while tempering urgency: Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no', meaning this is not a mass-exploitable remote bug but a device-local escalation requiring an attacker to already have code running on the device (the standard Android local-privesc model of a malicious or compromised app). This is not in CISA KEV and no POC is referenced, so it is not confirmed actively exploited. EPSS was not provided in the input, so exploitation probability cannot be quantified here. The vuln.today priority of 'this_week' is consistent with a high-impact local escalation that is patched but not under active exploitation - a real patch priority for the Android fleet rather than a drop-everything emergency. One note of caution: the description is Android's generic template ('multiple locations', 'logic error') and does not identify the exact component, so the precise trigger is not described in the available sources.

A user installs a malicious or trojanized app that holds no special permissions; the app abuses the logic error to launch background activities it should not be allowed to, escalating to higher privileges on the device without any user interaction. No public exploit code is referenced, so this reflects the mechanism implied by the CVSS local vector (AV:L/AC:L/PR:N/UI:N) rather than a demonstrated exploit.