{"id":"CVE-2026-58930","kind":"vulnerability","aliases":["CVE-2026-58930"],"related":[],"title":"Android SystemUI: spoofed Quick Controls panel lets apps launch activities","description":"An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element.","summary":"SystemUI's RemoteQCController resolves a hardcoded content:// URI without validating the providing package or signature. A malicious unprivileged app can claim that authority when the legitimate package is missing, inject fake controls into the trusted Quick Controls panel, and get a background activity launch grant when the user taps one.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","systemui"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T21:17:36+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","triaged_at":"2026-11-02T21:37:11+00:00","updated_at":"2026-11-02T21:37:11+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T21:37:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android SystemUI: spoofed Quick Controls panel lets apps launch activities","impact":"medium","summary":"SystemUI's RemoteQCController resolves a hardcoded content:// URI without validating the providing package or signature. A malicious unprivileged app can claim that authority when the legitimate package is missing, inject fake controls into the trusted Quick Controls panel, and get a background activity launch grant when the user taps one.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","systemui"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Malicious app spoofs trusted panel controls and launches activities","analyst_note":"Sources give only the NVD description; check the Android security bulletin for affected Android versions and the patched build.","how_to_check":"unknown","plain_action":"Install the latest Android security update on your phone and check your system updates in Settings.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":4167,"output_tokens":410,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-58930':13A,16A 'absent':103C 'activ':10A,61B,119C 'allow':89C 'android':1A,17B 'app':8A,37B 'applic':71C 'attack':91C 'author':41B,97C 'background':60B,118C 'bal':121C 'claim':39B 'control':5A,50B,55B,113C 'cve':11A,14A 'element':107C,132C 'exploit':73C 'fake':49B 'gain':116C 'get':58B 'grant':63B,122C 'hardcod':25B,86C 'infrastructur':18B 'inject':48B,104C 'interact':128C 'lack':75C 'launch':9A,62B,120C 'legitim':44B,100C 'let':7A 'malici':35B 'miss':47B 'one':68B 'packag':31B,45B,101C 'package/signature':77C 'panel':6A,56B,114C 'provid':30B 'quick':4A,54B,112C 'remoteqccontrol':22B,82C 'resolv':23B,84C 'signatur':33B 'specif':96C 'spoof':3A,105C,131C 'squat':93C 'systemui':2A,19B,20B,80C,111C,124C 'tap':67B 'trust':53B,110C 'ui':106C 'unprivileg':36B,70C 'uri':26B,87C 'user':66B,127C 'valid':28B,78C 'without':27B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","systemui","unknown"],"first_public_at":"2026-11-02T21:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58930","severity":null,"published_at":"2026-11-02T21:17:36+00:00","modified_at":"2026-11-02T21:17:36+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","fetched_at":"2026-11-02T21:35:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}