Live › vulnerability › CVE-2026-58915
On Android Automotive OS with multi-user multi-display, a physical occupant at the passenger screen can see sensitive heads-up notification content from a secure passenger user. The same flaw lets them trigger notification actions for that user without entering credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
Affects Android Automotive OS vehicles using multi-user multi-display with a passenger display and a secured passenger user. The sources do not name affected builds or patch levels. Systems without MUMD passenger displays are unlikely to be exposed.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification.
This page as .md · .json · in your agent: get_signal("CVE-2026-58915")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.