{"id":"CVE-2026-58957","kind":"vulnerability","aliases":["CVE-2026-58957"],"related":[],"title":"Android: background activity launch flaw allows local privilege escalation","description":"In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A confused deputy bug in Android's ActivityStarter.java lets an app trigger a background activity launch it should not be allowed to make. An attacker can use this to escalate privileges locally, without extra execution privileges and without user interaction.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"android","fixed":["2026-11-01 security patch level"],"affected":"14, 15, 16, 16-qpr2, 17 before security patch level 2026-11-01","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","framework","infrastructure","mobile","privilege-escalation"],"not_affected_if":["patched-device"],"how_to_check":"Settings > About phone > Android version > Android security update. If the date is earlier than 2026-11-01 (ideally 2026-11-05 or later), the device is exposed. Android 13 and older are not listed in the bulletin; check with your device maker.","fix":"Install the Android security update with patch level 2026-11-01 or later (the November 2026 bulletin says 2026-11-05 or later covers all its issues). Fixed in AOSP 14, 15, 16, 16-qpr2 and 17.","status":"open","published_at":"2026-11-02T20:17:52+00:00","first_seen_at":"2026-11-02T20:35:34+00:00","triaged_at":"2026-11-02T20:38:35+00:00","updated_at":"2026-11-02T20:39:33+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-02T20:38:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: background activity launch flaw allows local privilege escalation","impact":"high","summary":"A confused deputy bug in Android's ActivityStarter.java lets an app trigger a background activity launch it should not be allowed to make. An attacker can use this to escalate privileges locally, without extra execution privileges and without user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","mobile"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"A local app escalates privileges on the device","analyst_note":"Confirm affected Android versions and the patch level that fixes ActivityStarter.java, using the NVD entry and Android security bulletin.","how_to_check":"- Check the Android security patch level on the device: Settings > About phone > Android version and security update date.\n- unknown for fleet-level checks; the sources do not name affected builds.","plain_action":"Install the latest Android security update on your phone or tablet as soon as your manufacturer releases it.","needs_analyst":true,"not_affected_if":["patched-device"],"who_is_affected":"Android devices with the affected framework code. The flaw is local, so it requires a malicious app already installed on the device. Devices that are fully patched or running non-Android systems are not affected. unknown for exact affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4118,"output_tokens":506,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm affected Android versions and the patch level that fixes ActivityStarter.java, using the NVD entry and Android security bulletin.","search":"'-2026':11A,14A '-58957':12A,15A 'activ':3A,38B,73C 'activitystarter.java':31B,67C 'addit':90C 'allow':6A,44B 'android':1A,16A,17B,29B 'app':34B 'attack':48B 'background':2A,37B,72C 'bug':27B 'confus':25B,78C 'could':81C 'cve':10A,13A 'deputi':26B,79C 'due':75C 'escal':9A,23B,53B,85C 'execut':58B,91C 'exploit':100C 'extra':57B 'flaw':5A 'framework':18B 'infrastructur':19B 'interact':63B,95C 'launch':4A,39B,74C 'lead':82C 'let':32B 'local':7A,55B,84C 'make':46B 'mobil':20B 'need':93C,98C 'possibl':71C 'privileg':8A,22B,54B,59B,87C,92C 'privilege-escal':21B 'resolvetoheavyweightswitcherifneed':65C 'trigger':35B 'use':50B 'user':62B,94C 'without':56B,61B","nicknames":[],"mitigations":[],"who_affected":"Phones and tablets running Android 14, 15, 16, 16-qpr2 or 17 whose security patch level is earlier than 2026-11-01. A malicious app already installed on the device can use the flaw to gain higher privileges with no user interaction. Devices already updated to the November 2026 patch level can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-02T20:39:33Z","by":"analyst","doc":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","run_id":1424},"products":{"at":"2026-11-02T20:39:33Z","by":"analyst","doc":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","run_id":1424},"how_to_check":{"at":"2026-11-02T20:39:33Z","by":"analyst","doc":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","run_id":1424},"who_affected":{"at":"2026-11-02T20:39:33Z","by":"analyst","doc":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","run_id":1424}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Android phone to the November 2026 security update: Settings > Security & privacy > System & updates > Security update (menu names vary by phone).","pkeys":["android"],"ptokens":["android"],"labels":["android","framework","high","infrastructure","mobile","privilegeescalation"],"first_public_at":"2026-11-02T20:17:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58957","severity":null,"published_at":"2026-11-02T20:17:52+00:00","modified_at":"2026-11-02T20:17:52+00:00","first_seen_at":"2026-11-02T20:35:34+00:00","fetched_at":"2026-11-02T20:35:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-58957:1424","url":null,"severity":null,"published_at":"2026-11-02T20:39:33+00:00","modified_at":"2026-11-02T20:39:33+00:00","first_seen_at":"2026-11-02T20:39:33+00:00","fetched_at":"2026-11-02T20:39:33+00:00","note":"Android Security Bulletin Nov 2026 lists CVE-2026-58957 (A-500368515, Framework, EoP, High) under 2026-11-01 patch level, AOSP 14-17. No exploitation reported in the bulletin; no PoC found. Android 13 and older not listed."}],"documents":[{"id":53783,"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","title":"Android Security Bulletin—November 2026","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}