{"id":"CVE-2026-49906","kind":"vulnerability","aliases":["CVE-2026-49906"],"related":[],"title":"Android Automotive: unprivileged apps can show content on instrument cluster display","description":"An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.","summary":"An ordinary installed app can register an activity in the navigation category and have the privileged ClusterHomeSample app launch it on the car's instrument cluster screen, skipping the required permission check. An attacker can keep misleading or distracting content on the safety-critical cluster display.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android-automotive","automotive","infrastructure","instrument-cluster"],"not_affected_if":["no-cluster-display","no-third-party-apps"],"how_to_check":"- Check whether the vehicle or head unit runs Android Automotive OS and includes the ClusterHomeSample app\n- Check the installed Android Automotive build version against the vendor's advisory: unknown\n- Review whether third-party apps are installed on cluster-enabled head units: unknown","fix":null,"status":"open","published_at":"2026-11-02T21:17:31+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","triaged_at":"2026-11-02T21:37:18+00:00","updated_at":"2026-11-02T21:37:18+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T21:37:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android Automotive: unprivileged apps can show content on instrument cluster display","impact":"medium","summary":"An ordinary installed app can register an activity in the navigation category and have the privileged ClusterHomeSample app launch it on the car's instrument cluster screen, skipping the required permission check. An attacker can keep misleading or distracting content on the safety-critical cluster display.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["android-automotive","automotive","instrument-cluster"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"third-party app content persistently shown on the safety-critical instrument cluster","analyst_note":"Find the Android security bulletin or AOSP fix for CVE-2026-49906 and the affected Android Automotive versions.","how_to_check":"- Check whether the vehicle or head unit runs Android Automotive OS and includes the ClusterHomeSample app\n- Check the installed Android Automotive build version against the vendor's advisory: unknown\n- Review whether third-party apps are installed on cluster-enabled head units: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-cluster-display","no-third-party-apps"],"who_is_affected":"Affects Android Automotive head units that run the ClusterHomeSample application with an instrument cluster display. Systems without a cluster display, or without installable third-party apps, are less exposed. The sources do not name affected versions or a fix.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4199,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-49906':14A,17A 'act':101C 'activ':33B,87C,114C 'allow':129C 'android':1A,19B 'android-automot':18B 'android.car.cluster.navigation':90C 'android.car.permission.car':79C 'app':4A,29B,43B,95C 'applic':75C,100C 'arbitrari':110C 'attack':59B 'automot':2A,20B,21B 'bypass':77C 'car':48B 'categori':37B,91C 'check':57B,128C 'cluster':10A,25B,51B,71B,82C,121C 'clusterhomesampl':42B,99C 'confus':104C 'content':7A,65B,138C 'critic':70B,119C 'cve':12A,15A 'deputi':105C 'display':11A,72B,80C,122C,132C 'distract':64B,137C 'enforc':124C 'focus':96C 'infrastructur':22B 'instal':28B 'instrument':9A,24B,50B,120C 'instrument-clust':23B 'keep':61B 'launch':44B,108C 'mislead':62B,135C 'navig':36B,94C 'necessari':126C 'ordinari':27B 'parti':113C 'permiss':56B,83C,127C 'persist':131C 'potenti':134C 'privileg':41B,98C 'regist':31B,85C 'request':93C 'requir':55B 'resolv':106C 'safeti':69B,118C 'safety-crit':68B,117C 'screen':52B 'show':6A 'skip':53B 'third':112C 'third-parti':111C 'unprivileg':3A,74C 'without':123C","nicknames":[],"mitigations":[],"who_affected":"Affects Android Automotive head units that run the ClusterHomeSample application with an instrument cluster display. Systems without a cluster display, or without installable third-party apps, are less exposed. The sources do not name affected versions or a fix.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["androidautomotive","automotive","infrastructure","instrumentcluster","unknown"],"first_public_at":"2026-11-02T21:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49906","severity":null,"published_at":"2026-11-02T21:17:31+00:00","modified_at":"2026-11-02T21:17:31+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","fetched_at":"2026-11-02T21:35:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}