{"id":"CVE-2026-58796","kind":"vulnerability","aliases":["CVE-2026-58796"],"related":[],"title":"Android: exported broadcast receivers let apps trigger unauthorized firmware updates","description":"In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Several functions in an Android manifest export broadcast receivers without a permission check, so a local app can trigger firmware updates it should not be able to start. An attacker gets local privilege escalation with no extra execution rights and no user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","other"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:26+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","triaged_at":"2026-11-10T20:51:40+00:00","updated_at":"2026-11-10T20:51:40+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T20:51:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: exported broadcast receivers let apps trigger unauthorized firmware updates","impact":"high","summary":"Several functions in an Android manifest export broadcast receivers without a permission check, so a local app can trigger firmware updates it should not be able to start. An attacker gets local privilege escalation with no extra execution rights and no user interaction.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","mobile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Local app escalates privileges by triggering unauthorized firmware updates","analyst_note":"Identify the affected Android component, vendor and patched build from the NVD entry and the Android security bulletin.","how_to_check":"unknown","plain_action":"unknown","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Devices running the affected Android build whose manifest exports these broadcast receivers without a permission check. The sources do not name the vendor, the affected Android versions, or the component, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":4544,"output_tokens":440,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-58796':13A,16A 'abl':44B 'addit':97C 'android':1A,17B,23B 'androidmanifest.xml':66C 'app':6A,35B 'attack':48B 'broadcast':3A,26B,79C 'check':31B,86C 'could':88C 'cve':11A,14A 'due':81C 'escal':52B,92C 'execut':56B,98C 'exploit':107C 'export':2A,25B,78C 'extra':55B 'firmwar':9A,38B,75C 'function':20B,64C 'get':49B 'interact':61B,102C 'lead':89C 'let':5A 'local':34B,50B,91C 'manifest':24B 'miss':84C 'mobil':18B 'multipl':63C 'need':100C,105C 'permiss':30B,85C 'possibl':70C 'privileg':51B,94C,99C 'receiv':4A,27B,80C 'right':57B 'sever':19B 'start':46B 'trigger':7A,37B,73C 'unauthor':8A,74C 'updat':10A,39B,76C 'user':60B,101C 'via':77C 'way':71C 'without':28B","nicknames":[],"mitigations":[],"who_affected":"Devices running the affected Android build whose manifest exports these broadcast receivers without a permission check. The sources do not name the vendor, the affected Android versions, or the component, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","mobile","other","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-58796':13A,16A 'android':1A 'app':6A 'broadcast':3A 'cve':11A,14A 'export':2A 'firmwar':9A 'let':5A 'receiv':4A 'trigger':7A 'unauthor':8A 'updat':10A","search_b":"'abl':44B 'android':17B,23B 'app':35B 'attack':48B 'broadcast':26B 'check':31B 'escal':52B 'execut':56B 'export':25B 'extra':55B 'firmwar':38B 'function':20B 'get':49B 'interact':61B 'local':34B,50B 'manifest':24B 'mobil':18B 'permiss':30B 'privileg':51B 'receiv':27B 'right':57B 'sever':19B 'start':46B 'trigger':37B 'updat':39B 'user':60B 'without':28B","search_c":"'addit':97C 'androidmanifest.xml':66C 'broadcast':79C 'check':86C 'could':88C 'due':81C 'escal':92C 'execut':98C 'exploit':107C 'export':78C 'firmwar':75C 'function':64C 'interact':102C 'lead':89C 'local':91C 'miss':84C 'multipl':63C 'need':100C,105C 'permiss':85C 'possibl':70C 'privileg':94C,99C 'receiv':80C 'trigger':73C 'unauthor':74C 'updat':76C 'user':101C 'via':77C 'way':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58796","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58796","severity":null,"published_at":"2026-11-10T20:19:26+00:00","modified_at":"2026-11-10T20:19:26+00:00","first_seen_at":"2026-11-10T20:46:11+00:00","fetched_at":"2026-11-10T20:46:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}