Google Android CVE-2026-58946

Exploitation requires local access to the device - in practice an attacker-controlled or compromised application already running on it - because the vector is AV:L; it is reachable against default configurations with no special feature toggle named in the description. Per CVSS PR:N the triggering code path needs no pre-existing privileges and UI:N confirms no victim interaction is required. The primary limiting factors are: the attacker must already be able to execute code locally (e.g. a sideloaded or malicious app), the device must run an affected build (Android 17, Android 16, or Android 16-qpr2), and SSVC indicates the attack is not automatable, so it is a deliberate local action rather than a remote or self-propagating one.

This is a genuine high-severity local privilege-escalation issue, but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, 8.4) indicates a locally-reachable flaw requiring no prior privileges and no user interaction, with total impact to confidentiality, integrity and availability - consistent with CWE-693 (protection-mechanism failure) and the description's permission bypass in navigateUpTo of ActivityClientController.java. The SSVC framework agrees on severity (Technical Impact: total) but tempers urgency: Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no', meaning this is not a wormable or mass-scannable condition. There is no CISA KEV listing and no EPSS score supplied, so there is no quantitative exploitation-probability signal; absence of EPSS is a data gap, not evidence of low risk. The vuln.today decision label is 'this_week', signalling prompt-but-not-immediate patching. Net: real priority for Android fleet patching, but current signals point to no active exploitation rather than an in-the-wild emergency. Note AV:L means an attacker needs local code execution (typically a malicious or compromised on-device app) first, which materially constrains real-world reach despite the high base score.

A malicious application installed on the device, holding no special permissions and requiring no user interaction, invokes the affected activity-navigation path (navigateUpTo in ActivityClientController) to trigger the logic error and bypass a permission check. This yields local escalation of privilege, letting the app perform actions it should not be authorized for. No public exploit code has been identified at time of analysis.