Live › vulnerability › CVE-2026-49903
A method on Android's cluster rendering service accepts writes to a global display setting that normally needs a higher permission. An app holding the DUMP and PACKAGE_USAGE_STATS permissions can use it to create persistent system overlay displays and inject key events into the cluster UI.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
Only apps that already hold the android.permission.DUMP and android.permission.PACKAGE_USAGE_STATS permissions can reach the flaw, which are not normally granted to ordinary apps. Whether a given device or vehicle build is exposed depends on the vendor's firmware, which the sources do not state.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ClusterRenderingService.dump() method, accessible to processes holding android.permission.DUMP and android.permission.PACKAGE_USAGE_STATS, acts as a confused deputy. It allows attackers to write arbitrary values to Settings.Global.OVERLAY_DISPLAY_DEVICES, an operation normally requiring android.permission.WRITE_SECURE_SETTINGS, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.
This page as .md · .json · in your agent: get_signal("CVE-2026-49903")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.