Local Escalation of Privilege in OemLockService of Android Products
CVE-2026-58989

Currently unrated

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
2 November 2026

What is CVE-2026-58989?

A vulnerability in the OemLockService of Android products allows local escalation of privileges due to a missing permission check in the setOemUnlockAllowedByUser method. This flaw can be exploited without requiring any additional execution privileges, and user interaction is not necessary, making it a significant security concern for users of affected Android versions.

Affected Version(s)

Android 16-qpr2

Android 16

Android 15

References

https://source.android.com/docs/security/bulletin/2026/20...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.