EUVD-2026-115628
GHSA-88q8-635q-xgwm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall unprivileged malicious app on device
-
DeliveryInvoke addDragDropListener without required permission
-
ExploitBypass missing permission check in WindowManagerService
-
ExecutionEscalate to elevated privileges locally
-
ImpactAccess or control privileged data and functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to execute code locally on an Android XR 14 device - in practice, a locally installed, unprivileged application that calls the addDragDropListener path in WindowManagerService, which fails to enforce the required permission (CWE-862). Per the description and CVSS (PR:N/UI:N), no special privileges and no user interaction are needed once the app is running, and no non-default configuration is indicated. The primary limiting factors are: (1) the attack is local only (AV:L) - the attacker must already have code on the device; and (2) the target is Android XR 14 specifically, a narrowly deployed headset platform, which sharply constrains the realistic attack surface. The precise internal trigger within addDragDropListener is not described in the available sources beyond the missing permission check. |
| Impact | This is a locally-exploitable privilege-escalation flaw (CWE-862, missing permission check in addDragDropListener of WindowManagerService) in Android XR. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.4) indicates a low-complexity local attack requiring no privileges and no user interaction, with total confidentiality, integrity, and availability impact on the device - consistent with the SSVC 'Technical Impact: total' rating. However, the exploitation signals pull against the raw severity: SSVC reports Exploitation 'none' and Automatable 'no', there is no CISA KEV listing, no EPSS score was supplied, and no public exploit was provided. The vuln.today decision label is 'this_week', not act_now/emergency, which aligns with a serious-but-not-actively-exploited local flaw. The attack vector is genuinely local (AV:L), so this is not a remote mass-exploitation risk; it requires code already running on the device (e.g., a malicious installed app). Net assessment: a high-severity, patch-this-cycle issue bounded by its local vector and nascent target platform rather than a drop-everything emergency. Note the apparent tension that PR:N is paired with a purely local privilege-escalation outcome - the 'no additional execution privileges needed' description supports PR:N, meaning any unprivileged local app qualifies. |
| Exploit ScenarioDerived | A user installs a malicious or compromised application on an Android XR 14 device. Because addDragDropListener omits a permission check, the unprivileged app registers a drag-drop listener it should not be allowed to use and escalates to higher privileges with no user interaction, gaining access to data or capabilities belonging to more privileged components. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Android XR 14 contains a local privilege-escalation flaw in WindowManagerService, where the addDragDropListener path performs no permission check (CWE-862), so a locally installed, unprivileged app can register a drag-and-drop listener it should never be allowed to hold. Per the assessed vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, 8.4) the attacker must already have code running on the headset, but needs no privileges and no user interaction once that app is executing, and can then gain high-impact read and write capability over other applications' window/drag data. Exploitation is not confirmed (CISA SSVC exploitation: none, automatable: no), and no public exploit has been identified at time of analysis; the practical exposure is bounded by the narrow deployment base of the Android XR 14 headset platform.
RemediationAI
The fix is delivered through the Android XR Security Bulletin dated 2026-11-01 (https://source.android.com/docs/security/bulletin/xr/2026/2026-11-01), which is the vendor's patch vehicle for this issue; the input does not list an exact patched build or version string, and the bulletin's per-device build identifiers should be read directly from that advisory before asserting a patch level. Vulnerability intelligence rates this as this_week priority rather than emergency: there is no CISA KEV listing, SSVC records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis - so scheduling the XR monthly update in the current cycle is proportionate for headset fleets. No workaround or configuration-level mitigation is stated in the available sources; because the only precondition is that an unprivileged app already be running on the headset (AV:L, PR:N, UI:N), the practical interim exposure is governed by whatever application-installation policy the deployment already enforces on its Android XR 14 devices, and updating remains the complete fix once the bulletin build is available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WindowManagerService is the Android system service that owns window composition, input routing and cross-window drag-and-drop; drag events are the channel over which one app hands data (and content URIs, with temporary grants) to another, so listener registration on that channel is security-sensitive. The defect is a missing authorization check (CWE-862) inside addDragDropListener in WindowManagerService.java: the caller's identity/permission is not validated before the listener is attached, which is exactly the textbook CWE-862 pattern, though the sources do not name the specific permission that should have been enforced or describe the internal trigger beyond that absent check. The affected platform is Android XR 14 (CPE cpe:2.3:a:google:android_xr with an unconstrained version), Google's extended-reality headset OS, so the bug sits in the framework layer rather than in an app or a headset-specific driver; the CVSS metrics (AV:L, PR:N, UI:N) confirm the boundary crossed is the local app sandbox, not a remote or network boundary.
Know when Android Xr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local vector (a malicious app, AV:L); 'no additional execution privileges needed' justifies PR:N and low complexity (AC:L); missing permission check yields full local privilege escalation, so C/I/A:H.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
2DescriptionCVE.org
In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
CVE-2026-58873 is a high-severity local privilege-escalation flaw in Android XR 14 that allows an already-installed, unprivileged app to gain unauthorized access to other applications' window and drag-and-drop data. While exploitation requires a malicious app to already be running on the device, the impact is high: attackers could read or manipulate sensitive information from other apps, potentially compromising user privacy and enterprise data on affected headsets. Leadership should care because this vulnerability undermines the platform's app isolation model, and although no public exploit exists and the deployment base is currently narrow, the lack of a patch means any future malicious app could exploit this flaw without user interaction.
No vendor-released patch identified at time of analysis. Interim mitigations include strict app allowlisting to prevent installation of untrusted applications, monitoring for anomalous drag-and-drop listener activity, and limiting network exposure of affected headsets.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Android Xr
View allLocal privilege escalation in Android XR 14's MicroXR Blobstore component lets a co-resident malicious app read files be
Local privilege escalation in Google Android XR stems from a missing permission check in InputMethodManagerService.addIn
Exploit-DB