CVE-2026-49906
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER`…
- Risk score
- 47/100
- CVSS
- 7.8 v3.1
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An unprivileged application can bypass the android.car.permission.CAR_DISPLAY_IN_CLUSTER permission by registering an activity with the android.car.cluster.NAVIGATION category and requesting navigation app focus. The privileged ClusterHomeSample application, acting as a confused deputy, resolves and launches this arbi…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.8 high
References
Original description
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.
Last activity 2 Nov 2026. Patch Forecast updates every hour.