Permission Bypass Vulnerability in MusicFxHelper for Android Devices
CVE-2026-58965

8.4HIGH

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
2 November 2026

What is CVE-2026-58965?

The vulnerability in MusicFxHelper involves a potential permission bypass in the handleAudioEffectBroadcast function, which could allow an attacker to escalate privileges without requiring any user interaction. This flaw arises from improper handling of permissions, resulting in the possibility for local escalation of privilege and exposing the application to unauthorized actions.

Affected Version(s)

Android 17

Android 16-qpr2

Android 16

References

https://source.android.com/docs/security/bulletin/2026/20...

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.