---
id: "CVE-2026-49924"
kind: "vulnerability"
aliases: ["CVE-2026-49924"]
title: "Android launcher: unauthorized shortcuts can crash the home screen"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure", "launcher"]
not_affected_if: ["unknown"]
published_at: "2026-11-02T20:17:43+00:00"
first_seen_at: "2026-11-02T20:35:28+00:00"
updated_at: "2026-11-02T20:40:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49924", "first_seen_at": "2026-11-02T20:35:28+00:00"}]
---

# Android launcher: unauthorized shortcuts can crash the home screen

A flaw in Android's launcher code (ShortcutInfo.java) lets an app create unauthorized shortcuts that exhaust resources and crash the launcher. The result is a local denial of service, with no extra privileges or user interaction needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T20:35:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49924

## From the sources

In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_