Local Escalation of Privilege in ActivityStarter of Android

CVE-2026-58957

What is CVE-2026-58957?

In the ActivityStarter.java component of Android, there exists a scenario where a background activity may be launched unintentionally due to a confused deputy vulnerability. This security flaw allows for the escalation of privileges locally, meaning that an adversary could exploit this issue without requiring additional execution privileges or user interaction, creating potential risks for user systems and data security.

References