Android CVE-2026-58957

Requires local code execution on the device - in practice a locally installed app - which then abuses the confused-deputy flaw in resolveToHeavyWeightSwitcherIfNeeded within ActivityStarter.java to cause a privileged system component to perform a background activity launch on the attacker's behalf. Per the CVSS vector no additional execution privileges (PR:N) and no user interaction (UI:N) are needed. Limiting factors: the attack vector is Local (AV:L), so a remote attacker cannot exploit this directly without first getting code onto the device; exploitation is confined to affected Android versions (14, 15, 16, 16-qpr2, 17), and SSVC marks it as not automatable.

This is a locally-exploitable privilege escalation in Android's ActivityStarter component, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, base 8.4) describes a low-complexity local attack requiring no user interaction and no privileges, with total impact (C:H/I:H/A:H) - matching the SSVC 'Technical Impact: total' rating. However, the exploitation-side signals temper the raw score: SSVC reports 'Exploitation: none' and 'Automatable: no', there is no CISA KEV listing, no POC/exploit reference is provided, and no EPSS probability is supplied. The vuln.today decision label is 'this_week', i.e. a near-term patch priority rather than an emergency. The PR:N designation means the CVSS vector does not require an authenticated user, but note the attack vector is Local (AV:L), so realistic exploitation presupposes attacker code already running on the device (typically a malicious or compromised app with no special permissions) - this is standard for Android EoP and is not a contradiction, but it does bound real-world risk to devices where an untrusted app has been installed. Net: a genuinely high-severity flaw deserving prompt patching, but not evidence of active mass exploitation; treat as a 'patch this cycle' item, not a fire-drill.

A malicious app installed on the device, holding no special permissions, invokes the flawed resolveToHeavyWeightSwitcherIfNeeded path in ActivityStarter so that a privileged system component is tricked (confused deputy) into launching an activity on the attacker's behalf from the background. Because no user interaction is required (UI:N), this can occur silently, escalating the app's effective privileges locally. No public exploit code or PoC reference is provided in the available data.