Live › vulnerability › CVE-2026-58886
A logic error in updateInputWindows in Android's InputMonitor.java allows a tapjacking issue, where a user is tricked into tapping something they cannot see. The flaw can lead to local privilege escalation without extra execution privileges, but a user must interact with the attack.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Android devices whose system framework contains the affected InputMonitor code. The sources do not name the affected Android versions or patch levels, so the exact exposure is unknown. Devices kept on a current security patch level are the ones that would have the fix.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-58886")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.