high · CVSS v3 8.4

CVE-2026-58873

In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission c…

Description

In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Scores

Severity
high
CVSS v2
—
CVSS v3
8.4
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-58966

In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis

high

CVE-2026-58970

In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis

high

CVE-2026-58974

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis

high

CVE-2026-58975

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis