high · CVSS v3 7.8
CVE-2026-58979
CVE-2026-58979 is a logic error in PresentationController.java that allows local privilege escalation. The flaw permits bypassing permission
Overview
CVE-2026-58979 is a logic error in PresentationController.java that allows local privilege escalation. The flaw permits bypassing permission checks without user interaction. It affects Android OS components that use the PresentationController.
Description
In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Impact
The vulnerability can compromise the confidentiality, integrity, and availability of the device by allowing a local attacker to gain elevated privileges. Defenders should be aware that any user with local access could exploit the flaw. The attack does not require additional execution privileges or user interaction.
Remediation
Apply the latest security patch from Google that fixes the logic error in PresentationController.java. If a patch is not yet available, restrict local user accounts to the minimum required permissions and disable presentation features for untrusted users. Monitor device logs for anomalous permission escalation attempts.
Risk context
Severity is high with a CVSS v3 score of 7.8. The lack of EPSS data means the risk is based solely on severity. Defenders should treat this as a high-priority issue.
Affected products
- Google Android OS
Scores
- Severity
- high
- CVSS v2
- 4.6
- CVSS v3
- 7.8
- CVSS v4
- —
- EPSS
- —