---
id: "CVE-2026-49912"
kind: "vulnerability"
aliases: ["CVE-2026-49912"]
title: "Android: media can show after being disabled in carousel controller"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["android", "mobile", "runtime"]
not_affected_if: []
published_at: "2026-11-02T20:17:42+00:00"
first_seen_at: "2026-11-02T20:35:27+00:00"
updated_at: "2026-11-02T20:40:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49912", "first_seen_at": "2026-11-02T20:35:27+00:00"}]
---

# Android: media can show after being disabled in carousel controller

A logic error in MediaCarouselController.kt lets media keep showing after it has been disabled. An attacker on the device can read information that should have been hidden, without extra privileges or user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T20:35:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49912

## From the sources

In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_