EUVD-2026-78999
GHSA-mx7q-5vx8-m3w7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall unprivileged malicious app
-
ExploitInvoke FsmReleaseKey with crafted input
-
ExecutionTrigger improper-input-validation permission bypass
-
ImpactEscalate privileges locally
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires local code execution on the affected Android/Pixel device - i.e., a malicious or compromised app must already be installed and running (AV:L). No authentication credentials, elevated privileges, or user interaction are needed (PR:N/UI:N), and exploitation works against default configurations of the affected component. The practical limiting factor is the local-access precondition: the attacker must first get code onto the device (e.g., via a sideloaded or malicious Play app), and the device must be running an unpatched build predating the 2026-09-01 Pixel security patch level. |
| Impact | Signals are consistent and point to a genuine but not urgent local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a local, low-complexity flaw exploitable by any unprivileged app with no user interaction - the PR:N here is notable because most sibling Android EoPs in the same 2026-09-01 Pixel bulletin require System execution privileges (PR:H). EPSS is very low at 0.12% (2nd percentile), there is no CISA KEV listing and no public POC, so this is 'no public exploit identified at time of analysis.' The C:H/I:H/A:H triad is boilerplate common to Android EoP entries and is likely generous for what is fundamentally a permission-bypass logic flaw. No SSVC decision data was supplied. Net: a real patch-worthy local EoP for the Android/Pixel population, but not an actively-exploited or mass-exploitable priority - it requires attacker code already running locally on the device. |
| Exploit ScenarioDerived | A user installs a malicious or compromised app that carries no special privileges. The app invokes the vulnerable FsmReleaseKey path in fsm.c with crafted input that fails proper validation, bypassing a permission check to elevate its own privileges on the device, with no user interaction. No public exploit code is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Local privilege escalation in the Android kernel's FsmReleaseKey routine allows a malicious or compromised app already running on a Pixel device to bypass permission checks and gain kernel-level access, affecting confidentiality, integrity, and availability. Exploitation requires no credentials, no elevated privileges, and no user interaction (CVSS 8.4, AV:L/PR:N/UI:N), so any unpatched build predating the 2026-09-01 Pixel security patch level is exposed. No public exploit identified at time of analysis and EPSS is low at 0.12% (2nd percentile), so this is a genuine but non-urgent patching priority rather than an active threat.
Earlier versions of this analysis (1)
Local privilege escalation in Google Android lets an already-installed low-privilege app bypass permission checks through improper input validation in the FsmReleaseKey function of fsm.c, delivering high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires local access as a low-privilege application already running on the target device and depends on reaching the affected WLAN/firmware state-machine code path; no user interaction and no additional execution privileges are needed once the app is running. There is no evidence of remote or zero-click exploitation, confirmed actively exploited status is absent (no CISA KEV listing), and no public exploit code was identified at time of analysis; Pixel builds are the tracked remediation surface via the September 2026 Android/Pixel security bulletin.
RemediationAI
Apply the vendor fix by updating affected Pixel devices to the 2026-09-01 Pixel security patch level or later, as documented in the September 2026 Pixel bulletin (https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01); on supported Pixel hardware this is delivered through the standard monthly OTA and can be verified from the build's security patch level. Where immediate patching is impossible, the practical compensating controls are to reduce the local attack surface: enforce Google Play Protect and disable installation from unknown sources, keep sideloading and developer options off on managed devices, and remove or sandbox untrusted sideloaded applications - the trade-off is reduced flexibility for power users and developers, and none of these fully substitute for the kernel patch since the bypass only requires any locally executing code. Restricting the device to a managed work profile with strict app vetting lowers but does not eliminate the risk, and enterprise fleets should treat unpatched devices as elevated-risk endpoints until the SPL is confirmed. No public exploit code was identified at time of analysis, so there is no evidence of active exploitation driving emergency action.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in fsm.c within the Android kernel, specifically in the FsmReleaseKey function, which handles releasing a key resource. The root cause is CWE-20 (Improper Input Validation): malformed or unexpected input is not properly validated before the key-release path acts on it, causing a permission check to be skipped or satisfied incorrectly and letting a caller operate on a key object it should not be able to reach. Because this is kernel code on the Pixel platform (the reporting source is Google_Devices and the CPE is cpe:2.3:a:google:android), the permission bypass elevates a local app into the kernel trust boundary. The assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H matches the location: local access is the only precondition, default configurations are affected, and the resulting compromise is total across confidentiality, integrity, and availability within the impacted scope. It is tracked in the EU as EUVD-2026-78999 (CVE-2026-58691).
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local app with no privileges or UI triggers a permission bypass yielding privilege escalation, so AV:L/PR:N/UI:N; C/I/A:H retained as vendor-scored, though generous for a logic-bypass flaw.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
Executive ViewAI
Google Pixel smartphones used by your workforce are exposed to a high-severity vulnerability (CVE-2026-58691) that could allow a malicious app to silently take control of the device's core operating system. This creates a risk of unauthorized access to corporate email, credentials, and sensitive data stored on or accessed by affected devices, potentially undermining the security of your mobile fleet. No public exploit identified at time of analysis, and the low EPSS score of 0.12% suggests this is a manageable risk that nonetheless warrants timely patching once a fix is released.
Enforce MDM policies to prevent sideloading and restrict app installations to trusted sources (e.g., Google Play), enable Google Play Protect, and limit vulnerable devices' access to sensitive corporate data until the September 2026 Pixel security patch is available. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB