{"id":"CVE-2026-58934","kind":"vulnerability","aliases":["CVE-2026-58934"],"related":[],"title":"Android: window relayout logic error allows local permission bypass","description":"In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A logic error in Android's WindowState.java, in the prepareWindowToDisplayDuringRelayout function, allows a permission bypass. A local app could use it to escalate privileges without extra execution rights or user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mobile"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:50+00:00","first_seen_at":"2026-11-02T20:35:32+00:00","triaged_at":"2026-11-02T20:38:47+00:00","updated_at":"2026-11-02T20:38:47+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T20:38:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: window relayout logic error allows local permission bypass","impact":"high","summary":"A logic error in Android's WindowState.java, in the prepareWindowToDisplayDuringRelayout function, allows a permission bypass. A local app could use it to escalate privileges without extra execution rights or user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","mobile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local app gains elevated privileges on the device","analyst_note":"Check the Android Security Bulletin for the CVE-2026-58934 entry to confirm affected versions and the patch level that fixes it.","how_to_check":"- unknown","plain_action":"Install the latest Android security update on your phone once your manufacturer releases it.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Android devices whose framework includes the affected WindowState code. The sources do not name affected versions or builds, so unknown. Exposure requires a locally installed app to trigger the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000629,"input_tokens":4109,"output_tokens":436,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-58934':12A,15A 'addit':78C 'allow':6A,30B 'android':1A,16B,23B 'app':36B 'bypass':9A,33B,59C 'code':67C 'could':37B,69C 'cve':10A,13A 'due':60C 'error':5A,21B,64C 'escal':41B,73C 'execut':45B,79C 'exploit':88C 'extra':44B 'function':29B 'infrastructur':17B 'interact':49B,83C 'lead':70C 'local':7A,35B,72C 'logic':4A,20B,63C 'mobil':18B 'need':81C,86C 'permiss':8A,32B,58C 'possibl':57C 'preparewindowtodisplayduringrelayout':28B,51C 'privileg':42B,75C,80C 'relayout':3A 'right':46B 'use':38B 'user':48B,82C 'window':2A 'windowstate.java':25B,53C 'without':43B","nicknames":[],"mitigations":[],"who_affected":"Android devices whose framework includes the affected WindowState code. The sources do not name affected versions or builds, so unknown. Exposure requires a locally installed app to trigger the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mobile","unknown"],"first_public_at":"2026-11-02T20:17:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58934","severity":null,"published_at":"2026-11-02T20:17:50+00:00","modified_at":"2026-11-02T20:17:50+00:00","first_seen_at":"2026-11-02T20:35:32+00:00","fetched_at":"2026-11-02T20:35:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}