Permission Bypass in Android Car Navigation Apps by Google

CVE-2026-49906

What is CVE-2026-49906?

An unprivileged application can exploit a flaw in the Android operating system, allowing it to bypass the critical permission android.car.permission.CAR_DISPLAY_IN_CLUSTER. By registering an activity within the android.car.cluster.NAVIGATION category and seeking focus as a navigation application, the vulnerable setup permits the ClusterHomeSample application to act as a confused deputy. This application inadvertently resolves and executes arbitrary third-party activities on the vehicle's safety-critical instrument cluster display, leading to potential exposure of misleading or distracting content that could compromise driver attention and overall roadway safety.

References