Untrusted UI Vulnerability in Android Accessibility Services by Google
CVE-2026-58866

8.4HIGH

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
2 November 2026

What is CVE-2026-58866?

A security vulnerability has been identified in the setAccessibilityWindowAttributes method of the AccessibilityWindowManager.java file within Google Android. This flaw arises from a missing permission check, creating a potential for unauthorized local privilege escalation without requiring any additional execution privileges or user interaction. The implications of this vulnerability could allow malicious actors to manipulate the user interface misleadingly. It is crucial for users and developers to be aware of this risk and implement necessary patches or mitigations.

Affected Version(s)

Android 17

Android 16-qpr2

Android 16

References

https://source.android.com/docs/security/bulletin/2026/20...

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.