Live › vulnerability › CVE-2026-58930
SystemUI's RemoteQCController resolves a hardcoded content:// URI without validating the providing package or signature. A malicious unprivileged app can claim that authority when the legitimate package is missing, inject fake controls into the trusted Quick Controls panel, and get a background activity launch grant when the user taps one.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An unprivileged application can exploit a lack of package/signature validation in SystemUI's RemoteQCController when resolving a hardcoded content:// URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element.
This page as .md · .json · in your agent: get_signal("CVE-2026-58930")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.