high · CVSS v3 7.5

CVE-2026-49903

CVE-2026-49903 exploits a confused‑deputy flaw in Android’s ClusterRenderingService.dump() allowing privileged processes to write to Setting

Overview

CVE-2026-49903 exploits a confused‑deputy flaw in Android’s ClusterRenderingService.dump() allowing privileged processes to write to Settings.Global.OVERLAY_DISPLAY_DEVICES. This enables persistent system overlay displays and key‑event injection into the cluster UI. The vulnerability can be leveraged to hijack user input and display malicious content.

Description

The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.

Impact

The flaw compromises integrity by allowing unauthorized modification of system overlay settings and key‑event injection, potentially enabling keylogging, UI redirection, and malicious content display. Availability can be affected through UI disruption or denial of legitimate overlay functionality. Confidentiality is not directly impacted, but attackers could capture user input. Defenders include Android device users, enterprise IT admins, and app developers.

Remediation

Apply the vendor‑issued patch that enforces proper permission checks on ClusterRenderingService.dump(). Disable or restrict the android.permission.DUMP and android.permission.PACKAGE_USAGE_STATS permissions for untrusted apps. Update to the latest Android release, enable SELinux enforcing mode, and monitor for abnormal overlay creation or key‑event injection. Use device‑policy controls to block overlay permissions on critical devices.

Risk context

The vulnerability is rated high severity with a CVSS v3 score of 7.5. No EPSS data is available, but the high score indicates a significant risk that should be addressed promptly by applying the vendor patch and tightening permission controls.

Affected products

  • Android OS
  • Android System UI
  • Android Settings
  • Android Framework
  • Android Device Administration
  • Android Security Settings
  • Android Overlay Manager
  • Android Permission System

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
—
EPSS
—

Android Overlay Permission ConfusedDeputy KeyInjection HighSeverity UIHijack

← All CVEs

Related CVEs

high

CVE-2026-119301

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

View analysis

high

CVE-2026-120830

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

View analysis

high

CVE-2026-120833

Labbench versions prior to 0.46.1 deserialize untrusted .p or .pickle files using pandas.read_pickle, enabling arbitrary code execution when a user loads such files. The flaw allows attackers to run malicious code on the host system. It is a high‑severity vulnerability that can compromise confidentiality, integrity, and availability of affected installations.

View analysis

high

CVE-2026-107441

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

View analysis