{"id":"CVE-2026-56926","kind":"vulnerability","aliases":["CVE-2026-56926"],"related":[],"title":"Android: subscription switch spoofing can reboot device and escalate privileges locally","description":"In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and trigger a device reboot due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"PssSubscriptionManager.java has several functions that can be tricked into spoofing subscription switch results and triggering a device reboot through a confused deputy. A local app could use this to escalate privileges without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:15+00:00","first_seen_at":"2026-11-10T20:46:07+00:00","triaged_at":"2026-11-10T20:53:47+00:00","updated_at":"2026-11-10T20:53:47+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T20:53:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: subscription switch spoofing can reboot device and escalate privileges locally","impact":"medium","summary":"PssSubscriptionManager.java has several functions that can be tricked into spoofing subscription switch results and triggering a device reboot through a confused deputy. A local app could use this to escalate privileges without user interaction.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","mobile"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Local app escalates privileges and forces a device reboot","analyst_note":"Confirm affected Android versions and the patch level from the NVD entry or the Android Security Bulletin that lists CVE-2026-56926.","how_to_check":"unknown","plain_action":"Install the latest Android security update on your phone once your manufacturer releases it.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name affected Android versions or devices. Affected systems would be those containing the PssSubscriptionManager component; the sources do not say which ones.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000676,"input_tokens":4538,"output_tokens":444,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-56926':14A,17A 'addit':89C 'android':1A,18B 'app':44B 'confus':40B,77C 'could':45B,80C 'cve':12A,15A 'deputi':41B,78C 'devic':7A,36B,72C 'due':74C 'escal':9A,49B,84C 'execut':90C 'exploit':99C 'function':23B,56C 'interact':53B,94C 'lead':81C 'local':11A,43B,83C 'mobil':19B 'multipl':55C 'need':92C,97C 'possibl':62C 'privileg':10A,50B,86C,91C 'psssubscriptionmanager.java':20B,58C 'reboot':6A,37B,73C 'result':32B,68C 'sever':22B 'spoof':4A,29B,65C 'subscript':2A,30B,66C 'switch':3A,31B,67C 'trick':27B 'trigger':34B,70C 'use':46B 'user':52B,93C 'way':63C 'without':51B","nicknames":[],"mitigations":[],"who_affected":"The sources do not name affected Android versions or devices. Affected systems would be those containing the PssSubscriptionManager component; the sources do not say which ones.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","mobile","other","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-56926':14A,17A 'android':1A 'cve':12A,15A 'devic':7A 'escal':9A 'local':11A 'privileg':10A 'reboot':6A 'spoof':4A 'subscript':2A 'switch':3A","search_b":"'android':18B 'app':44B 'confus':40B 'could':45B 'deputi':41B 'devic':36B 'escal':49B 'function':23B 'interact':53B 'local':43B 'mobil':19B 'privileg':50B 'psssubscriptionmanager.java':20B 'reboot':37B 'result':32B 'sever':22B 'spoof':29B 'subscript':30B 'switch':31B 'trick':27B 'trigger':34B 'use':46B 'user':52B 'without':51B","search_c":"'addit':89C 'confus':77C 'could':80C 'deputi':78C 'devic':72C 'due':74C 'escal':84C 'execut':90C 'exploit':99C 'function':56C 'interact':94C 'lead':81C 'local':83C 'multipl':55C 'need':92C,97C 'possibl':62C 'privileg':86C,91C 'psssubscriptionmanager.java':58C 'reboot':73C 'result':68C 'spoof':65C 'subscript':66C 'switch':67C 'trigger':70C 'user':93C 'way':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56926","severity":null,"published_at":"2026-11-10T20:19:15+00:00","modified_at":"2026-11-10T20:19:15+00:00","first_seen_at":"2026-11-10T20:46:07+00:00","fetched_at":"2026-11-10T20:46:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}