Live › vulnerability › CVE-2026-58969
Several functions in Android's MediaQualityService.java lack a permission check, so code that should be blocked can run them. An attacker on the device gets local information disclosure without extra execution privileges and without user interaction.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Affects Android devices with the MediaQualityService component; exposure depends on the device build and its security patch level. The sources do not say which Android versions or manufacturers are affected. Only local code on the device can trigger it, so a device with no untrusted apps installed is at lower risk.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-58969")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.