{"id":"CVE-2026-58944","kind":"vulnerability","aliases":["CVE-2026-58944"],"related":[],"title":"Android: background app launch flaw lets an app escalate privileges locally","description":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A confused-deputy flaw in moveTaskToFrontLocked in Android's ActivityTaskManagerService allows a background application launch. An attacker-controlled app can use it to escalate privileges on the device without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mobile"],"not_affected_if":["up-to-date-patch-level"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:51+00:00","first_seen_at":"2026-11-02T20:35:33+00:00","triaged_at":"2026-11-02T20:38:41+00:00","updated_at":"2026-11-02T20:38:41+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T20:38:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: background app launch flaw lets an app escalate privileges locally","impact":"high","summary":"A confused-deputy flaw in moveTaskToFrontLocked in Android's ActivityTaskManagerService allows a background application launch. An attacker-controlled app can use it to escalate privileges on the device without user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","mobile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local app gains elevated privileges on the device","analyst_note":"Confirm the affected Android versions and the patch level that fixes CVE-2026-58944 from the Android security bulletin or NVD.","how_to_check":"- unknown","plain_action":"Install the latest Android security update on your phone once your manufacturer releases it.","needs_analyst":true,"not_affected_if":["up-to-date-patch-level"],"who_is_affected":"Android devices whose system framework includes the affected ActivityTaskManagerService code. Exposure depends on the device's patch level, which the sources do not state. unknown","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":4113,"output_tokens":437,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-58944':14A,17A 'activitytaskmanagerservic':31B 'activitytaskmanagerservice.java':57C 'addit':82C 'allow':32B 'android':1A,18B,29B 'app':3A,8A,41B 'applic':35B,63C 'attack':39B 'attacker-control':38B 'background':2A,34B,62C 'bal':65C 'confus':23B,70C 'confused-deputi':22B 'control':40B 'could':73C 'cve':12A,15A 'deputi':24B,71C 'devic':50B 'due':67C 'escal':9A,46B,77C 'execut':83C 'exploit':92C 'flaw':5A,25B 'infrastructur':19B 'interact':53B,87C 'issu':66C 'launch':4A,36B,64C 'lead':74C 'let':6A 'local':11A,76C 'mobil':20B 'movetasktofrontlock':27B,55C 'need':85C,90C 'possibl':61C 'privileg':10A,47B,79C,84C 'use':43B 'user':52B,86C 'without':51B","nicknames":[],"mitigations":[],"who_affected":"Android devices whose system framework includes the affected ActivityTaskManagerService code. Exposure depends on the device's patch level, which the sources do not state. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mobile","unknown"],"first_public_at":"2026-11-02T20:17:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58944","severity":null,"published_at":"2026-11-02T20:17:51+00:00","modified_at":"2026-11-02T20:17:51+00:00","first_seen_at":"2026-11-02T20:35:33+00:00","fetched_at":"2026-11-02T20:35:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}