Android CVE-2026-58877

Requires local code execution context on the device - typically a separately installed app - that does NOT hold the nearby-devices (and associated location) permission; the flaw lets that app bypass the checkNearbyDevicesPermission guard in WifiP2pServiceImpl via a confused deputy and read Wi-Fi P2P / nearby-device information it is not authorized to access. No user interaction and no elevated privileges are needed (PR:N, UI:N). Exploitation is limited by the need for local presence on the device (AV:L - no remote vector) and by the restricted scope of data exposed (C:L only; no integrity or availability impact). Affected builds are Android 14, 15, 16, 16-qpr2 and 17.

Signals are consistent and point to a genuine but low-to-moderate priority issue rather than an urgent one. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) scores 4.0 (Medium): exploitation is local, low-complexity, requires no privileges and no user interaction, but yields only limited confidentiality impact (C:L) with no integrity or availability effect - matching the description's 'local information disclosure with no additional execution privileges needed.' EPSS reinforces low urgency at 0.12% (2nd percentile), indicating very low near-term exploitation probability. The CVE is not listed in CISA KEV and no proof-of-concept or exploit reference is provided, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not act_now or emergency. No SSVC exploitation/automatable/technical-impact decision points are supplied in the input, so that framework cannot be cross-referenced. The AV:L vector is confirmed by the description ('local information disclosure'), so there is no network-vs-local conflict here. Overall: a legitimate confused-deputy permission-bypass flaw worth patching on the normal Android monthly cycle, but not a widespread-exploitation emergency.

A malicious or low-privileged app already installed on the device, lacking the nearby-devices/location permission, invokes the Wi-Fi P2P interface whose checkNearbyDevicesPermission logic acts as a confused deputy, causing the privileged system service to disclose nearby-device/Wi-Fi P2P information the app should not be able to read. Exploitation is local, requires no user interaction and no special privileges, but gains only limited confidential data. No public exploit code is identified at time of analysis.