Bypass Vulnerability in Android Automotive OS Multi-User Display

CVE-2026-58915

What is CVE-2026-58915?

A vulnerability in the Android Automotive OS's Multi-User Multi-Display system allows an unauthorized occupant to view sensitive Heads-Up Notification (HUN) content. This occurs due to a flaw in the PassengerKeyguard, which fails to adequately suppress HUNs or intercept action PendingIntents. As a result, an unauthorized user can execute actions intended for a secure passenger account without proper authentication, bypassing essential security measures tied to the driver's display.

References