Live › vulnerability › CVE-2026-49906
An ordinary installed app can register an activity in the navigation category and have the privileged ClusterHomeSample app launch it on the car's instrument cluster screen, skipping the required permission check. An attacker can keep misleading or distracting content on the safety-critical cluster display.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
Affects Android Automotive head units that run the ClusterHomeSample application with an instrument cluster display. Systems without a cluster display, or without installable third-party apps, are less exposed. The sources do not name affected versions or a fix.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An unprivileged application can bypass the android.car.permission.CAR_DISPLAY_IN_CLUSTER permission by registering an activity with the android.car.cluster.NAVIGATION category and requesting navigation app focus. The privileged ClusterHomeSample application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.
This page as .md · .json · in your agent: get_signal("CVE-2026-49906")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.