{"id":"CVE-2026-56947","kind":"vulnerability","aliases":["CVE-2026-56947"],"related":[],"title":"Android: carrier restriction status call bypasses permissions, leaking local information","description":"In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A flaw in Android's PhoneInterfaceManager getCarrierRestrictionStatus function lets an app bypass a permission check through a confused deputy. An attacker-controlled app on the device can read information it should not be able to see.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:16+00:00","first_seen_at":"2026-11-10T20:46:07+00:00","triaged_at":"2026-11-10T20:52:19+00:00","updated_at":"2026-11-10T20:52:19+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-10T20:52:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: carrier restriction status call bypasses permissions, leaking local information","impact":"low","summary":"A flaw in Android's PhoneInterfaceManager getCarrierRestrictionStatus function lets an app bypass a permission check through a confused deputy. An attacker-controlled app on the device can read information it should not be able to see.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["android","mobile"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"A local app reads carrier restriction information it should not access","analyst_note":"Check the Android security bulletin and AOSP commit for the affected versions and fixed patch level for CVE-2026-56947.","how_to_check":"unknown","plain_action":"","product_name":"Android","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources describe a local information disclosure in Android's telephony code, with no extra privileges or user interaction needed. Which Android versions and devices are affected is unknown from the sources.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00067,"input_tokens":4536,"output_tokens":432,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-56947':13A,16A 'abl':54B 'addit':81C 'android':1A,17B,23B 'app':30B,43B 'attack':41B 'attacker-control':40B 'bypass':6A,31B,66C 'call':5A 'carrier':2A 'check':34B 'confus':37B,70C 'control':42B 'could':73C 'cve':11A,14A 'deputi':38B,71C 'devic':46B 'disclosur':78C 'due':67C 'execut':82C 'exploit':91C 'flaw':21B 'function':27B 'getcarrierrestrictionstatus':26B,58C 'inform':10A,49B,77C 'interact':86C 'lead':74C 'leak':8A 'let':28B 'local':9A,76C 'mobil':18B 'need':84C,89C 'permiss':7A,33B,65C 'phoneinterfacemanag':25B 'phoneinterfacemanager.java':60C 'possibl':64C 'privileg':83C 'read':48B 'restrict':3A 'runtim':19B 'see':56B 'status':4A 'user':85C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a local information disclosure in Android's telephony code, with no extra privileges or user interaction needed. Which Android versions and devices are affected is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","mobile","runtime","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-56947':13A,16A 'android':1A 'bypass':6A 'call':5A 'carrier':2A 'cve':11A,14A 'inform':10A 'leak':8A 'local':9A 'permiss':7A 'restrict':3A 'status':4A","search_b":"'abl':54B 'android':17B,23B 'app':30B,43B 'attack':41B 'attacker-control':40B 'bypass':31B 'check':34B 'confus':37B 'control':42B 'deputi':38B 'devic':46B 'flaw':21B 'function':27B 'getcarrierrestrictionstatus':26B 'inform':49B 'let':28B 'mobil':18B 'permiss':33B 'phoneinterfacemanag':25B 'read':48B 'runtim':19B 'see':56B","search_c":"'addit':81C 'bypass':66C 'confus':70C 'could':73C 'deputi':71C 'disclosur':78C 'due':67C 'execut':82C 'exploit':91C 'getcarrierrestrictionstatus':58C 'inform':77C 'interact':86C 'lead':74C 'local':76C 'need':84C,89C 'permiss':65C 'phoneinterfacemanager.java':60C 'possibl':64C 'privileg':83C 'user':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56947","severity":null,"published_at":"2026-11-10T20:19:16+00:00","modified_at":"2026-11-10T20:19:16+00:00","first_seen_at":"2026-11-10T20:46:07+00:00","fetched_at":"2026-11-10T20:46:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}