CVE-2026-58866

In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible…

Risk score: 50/100
CVSS: 8.4 v3.1
Published: 2 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.4 high

References

https://source.android.com/docs/security/bulletin/2026/2026-11-01

Original description

In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Last activity 2 Nov 2026. Patch Forecast updates every hour.