CVE-2026-58796 · Other
NO FIX YET
Several functions in an Android manifest export broadcast receivers without a permission check, so a local app can trigger firmware updates it should not be able to start. An attacker gets local privilege escalation with no extra execution rights and no user interaction.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Devices running the affected Android build whose manifest exports these broadcast receivers without a permission check. The sources do not name the vendor, the affected Android versions, or the component, so the exact exposure is unknown.
Not affected if unknown
Who cares android, mobile
Unknown from the sources.
No fix yet, per the sources.
In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.