Android Automotive OS EUVD-2026-115616

Requires a locally installed, unprivileged third-party application on an Android Automotive OS device whose build includes the privileged ClusterHomeSample app (an AOSP sample that resolves and launches cluster activities without enforcing android.car.permission.CAR_DISPLAY_IN_CLUSTER). The malicious app must declare an activity with the android.car.cluster.NAVIGATION category and request navigation app focus to be launched on the instrument cluster. Limiting factors: there is no remote vector (the attacker must first get an app onto the head unit); exploitation is gated on the vehicle actually shipping the vulnerable ClusterHomeSample/confused-deputy code path rather than an OEM's own hardened cluster implementation; affected builds are Android 14 through 17, including 16-qpr2.

Signals point to a genuine-but-non-urgent issue rather than a widespread threat. CVSS is 7.8 (High) with a LOCAL vector (AV:L/AC:L/PR:L/UI:N): exploitation requires a malicious but unprivileged app already installed on the Android Automotive OS (AAOS) head unit, not remote reach. The exploitation signals are consistently low: EPSS is 0.18% (8th percentile), SSVC reports Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public exploit identified at time of analysis - so there is no evidence of active or scalable exploitation. The one strong signal is SSVC Technical Impact: total, which matches the input CVSS impact triad C:H/I:H/A:H. That triad looks inflated relative to the described effect (a confused-deputy permission bypass that displays arbitrary/misleading content on the instrument cluster); the confidentiality claim (C:H) is not substantiated by the description, which describes unauthorized display rather than data disclosure - verify the impact scoring with Google. The vuln.today priority is 'this_week', consistent with a High-severity but locally-gated automotive flaw that warrants patching on a normal cadence rather than emergency treatment.

A malicious, unprivileged Android app is installed on an AAOS vehicle head unit. The app registers an activity under the android.car.cluster.NAVIGATION category and requests navigation app focus; the privileged ClusterHomeSample app, without checking the CAR_DISPLAY_IN_CLUSTER permission, resolves and launches that third-party activity on the safety-critical instrument cluster, persistently showing misleading or distracting content. No public exploit identified at time of analysis.