Confused Deputy Vulnerability in Android ClusterRenderingService
CVE-2026-49903

Currently unrated

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
2 November 2026

What is CVE-2026-49903?

The ClusterRenderingService.dump() method in Android creates a potential security risk by acting as a confused deputy. With the right permissions, attackers can manipulate settings that typically require elevated privileges, namely Settings.Global.OVERLAY_DISPLAY_DEVICES. This exploit could lead to unauthorized creation of persistent overlay displays and the injection of simulated key events into the cluster user interface, potentially compromising user interaction and data integrity.

Affected Version(s)

Android 17

Android 16-qpr2

Android 16

References

https://source.android.com/docs/security/bulletin/aaos/20...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.