Google Android CVE-2026-58885

Exploitation requires a local attacker presence on the device - in practice an already-installed malicious or compromised application running on Android 17 - which then invokes a privileged system component that fails to validate the caller's permissions (the confused deputy). No user interaction is required (UI:N) and no additional execution privileges are needed beyond initial app installation. Limiting factors: the attack is strictly local (AV:L), so there is no remote network exploitation path; an attacker must first get code running on the device, and the flaw affects Android 17 specifically. The precise vulnerable components ('multiple locations') and the exact trigger conditions are not described in the available sources.

Signals are moderately consistent and point to a serious-but-not-emergency local flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a locally-exploitable confused-deputy (CWE-441) that yields total compromise of the affected component without user interaction, which aligns with the SSVC Technical Impact of 'total'. However, the risk signals that drive urgency are low: SSVC reports Exploitation 'none' and Automatable 'no', no CISA KEV listing is present, and no EPSS probability was supplied in the input - so there is no evidence of active or scalable exploitation. The vuln.today Decision label is 'this_week', consistent with a high-impact local privilege escalation that warrants prompt patching but is not flagged act_now or emergency. Note a tension worth flagging: the vector sets PR:N, yet real-world exploitation of an Android confused-deputy escalation typically requires a malicious or compromised app already present on the device (local attacker position via AV:L) - PR:N reflects that the vulnerable privileged component grants access without the attacker holding those privileges, not that the device is remotely reachable. No EPSS score and no public exploit reference are present in the data, so widespread-exploitation likelihood cannot be quantified from these sources.

A malicious or compromised low-privilege app installed on an Android 17 device abuses a privileged system component that performs an action on the app's behalf without correctly checking the caller's permissions (confused deputy). Because no user interaction and no additional execution privileges are required, the app silently escalates to the privileges of the deputy component, gaining high confidentiality, integrity, and availability impact on the device. No public exploit identified at time of analysis.