{"id":"CVE-2026-49931","kind":"vulnerability","aliases":["CVE-2026-49931"],"related":[],"title":"Android: contacts from protected profile leak through confused deputy","description":"In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Several onActivityResult handlers can be tricked into exposing contact data from a protected profile. A local app with no extra permissions can use this to escalate its privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mobile-devices"],"not_affected_if":["no-protected-profile"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:43+00:00","first_seen_at":"2026-11-02T20:35:28+00:00","triaged_at":"2026-11-02T20:40:44+00:00","updated_at":"2026-11-02T20:40:44+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T20:40:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: contacts from protected profile leak through confused deputy","impact":"high","summary":"Several onActivityResult handlers can be tricked into exposing contact data from a protected profile. A local app with no extra permissions can use this to escalate its privileges.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","mobile-devices"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"local app reads protected profile contacts and escalates privileges","analyst_note":"Identify affected Android versions and patch level from the NVD entry or Android security bulletin; the sources give no product ranges.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-protected-profile"],"who_is_affected":"Android devices with a protected (work or private) profile; the sources do not name affected versions or OS builds. Only devices with a locally installed app that can trigger the flaw are at risk, and no user interaction is required per the description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000611,"input_tokens":4090,"output_tokens":404,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-49931':12A,15A 'addit':78C 'android':1A,16B 'app':37B 'confus':8A,66C 'contact':2A,29B,58C 'could':69C 'cve':10A,13A 'data':30B 'deputi':9A,67C 'devic':20B 'due':63C 'escal':46B,73C 'execut':79C 'exploit':88C 'expos':28B 'extra':40B 'handler':23B 'infrastructur':17B 'interact':83C 'lead':70C 'leak':6A,59C 'local':36B,72C 'locat':53C 'mobil':19B 'mobile-devic':18B 'multipl':52C 'need':81C,86C 'onactivityresult':22B,50C 'permiss':41B 'possibl':57C 'privileg':48B,75C,80C 'profil':5A,34B,62C 'protect':4A,33B,61C 'sever':21B 'trick':26B 'use':43B 'user':82C","nicknames":[],"mitigations":[],"who_affected":"Android devices with a protected (work or private) profile; the sources do not name affected versions or OS builds. Only devices with a locally installed app that can trigger the flaw are at risk, and no user interaction is required per the description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mobiledevices","unknown"],"first_public_at":"2026-11-02T20:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49931","severity":null,"published_at":"2026-11-02T20:17:43+00:00","modified_at":"2026-11-02T20:17:43+00:00","first_seen_at":"2026-11-02T20:35:28+00:00","fetched_at":"2026-11-02T20:35:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}