Google Android CVE-2026-58841

Exploitation requires local access with an already-present low-privileged context on the device (PR:L, AV:L) - in practice a malicious or compromised app running locally - because the flaw is a logic error in the permission check within VirtualAudioControllerTest.java. No user interaction is required (UI:N) and no additional execution privileges are needed once the attacker has that local foothold. Limiting factors: the attacker cannot exploit this remotely and must first achieve local code execution; the issue is bounded to affected Android versions (14 through 17, including 16-qpr2) and is mitigated by applying the 2026-10-01 security patch level.

This is a CWE-269 permission-bypass/privilege-escalation flaw in Android with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vector signals require local access and some existing privilege (PR:L), with no user interaction, yielding total confidentiality, integrity, and availability impact on the affected component - consistent with the SSVC 'Technical Impact: total' rating. However, the real-world exploitation signals are notably cooler than the severity: SSVC reports Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public exploit code is identified. There is no EPSS score provided in the input to corroborate exploitation probability. The high score is therefore driven by impact magnitude, not by ease or evidence of exploitation. Net: a genuine, patch-worthy local EoP typical of Android monthly bulletins, but not an emergency-grade, actively-exploited threat at time of analysis. The 'Automatable: no' plus local-only vector means it is unlikely to be wormable or mass-exploited; it is most relevant as a chained post-compromise step (e.g., after a malicious app is already installed).

A malicious or compromised low-privileged app already installed on an Android device invokes the flawed logic in VirtualAudioControllerTest.java to bypass a permission check and escalate to elevated privileges, without needing additional execution privileges or any user interaction. No public exploit code is identified at time of analysis, and because the attack vector is local (AV:L) the attacker must first obtain code execution on the device.