Google Android CVE-2026-58965

Exploitation requires local presence on the device - specifically a locally installed, unprivileged application able to issue the audio-effect broadcast processed by handleAudioEffectBroadcast in MusicFxHelper.java; the confused-deputy condition then causes a more privileged Android component to act on the attacker's behalf. No user interaction and no additional execution privileges are required (UI:N, PR:N). The practical limiting factor is that this is not remotely reachable (AV:L): the attacker must already be able to run code on the device, and only Android versions 14, 15, 16, 16-qpr2, and 17 are listed as affected. The precise trigger conditions of the broadcast handling beyond the confused-deputy description are not detailed in the available sources.

This is a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a locally-triggered privilege escalation: an attacker needs local presence on the device (a malicious or compromised app) but no pre-existing privileges (PR:N) and no user interaction (UI:N), yielding full confidentiality, integrity and availability impact. CISA's SSVC framing agrees on severity (Technical Impact: total) but tempers urgency: Exploitation is assessed as 'none' (no observed or public exploitation) and Automatable is 'no', consistent with a local EoP that cannot be sprayed remotely. The vuln.today decision label is 'this_week' rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no PoC reference are present in the input, so there is no public exploit identified at time of analysis. Net: a high-impact local privilege-escalation bug worth patching on the normal Android monthly cadence, not a drop-everything remote threat. Note the signals are internally consistent - AV:L matches the description's 'local escalation of privilege' - so there is no attack-vector conflict to flag here.

A malicious application already installed on the device (requiring no special permissions) sends a crafted audio-effect broadcast that MusicFxHelper handles on behalf of a more privileged component. Because of the confused-deputy flaw, that privileged component performs the requested action, letting the app escalate its privileges locally with no user interaction. No public exploit code is identified in the available sources.