{"id":"CVE-2026-58969","kind":"vulnerability","aliases":["CVE-2026-58969"],"related":[],"title":"Android MediaQualityService: missing permission check lets apps read data locally","description":"In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Several functions in Android's MediaQualityService.java lack a permission check, so code that should be blocked can run them. An attacker on the device gets local information disclosure without extra execution privileges and without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","runtime"],"not_affected_if":["fully-patched-device"],"how_to_check":"- Check the device's Android security patch level under Settings > About phone; the sources do not name a fixed patch level.","fix":null,"status":"open","published_at":"2026-11-02T20:17:53+00:00","first_seen_at":"2026-11-02T20:35:34+00:00","triaged_at":"2026-11-02T20:38:28+00:00","updated_at":"2026-11-02T20:38:28+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-02T20:38:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android MediaQualityService: missing permission check lets apps read data locally","impact":"low","summary":"Several functions in Android's MediaQualityService.java lack a permission check, so code that should be blocked can run them. An attacker on the device gets local information disclosure without extra execution privileges and without user interaction.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["android","mobile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Local apps read information they should not have access to.","analyst_note":"Find the affected Android versions and the patch level that fixes CVE-2026-58969 in the Android security bulletin.","how_to_check":"- Check the device's Android security patch level under Settings > About phone; the sources do not name a fixed patch level.\n- unknown for the exact affected Android versions.","plain_action":"Install the latest Android system update on your phone once your manufacturer releases it.","needs_analyst":true,"not_affected_if":["fully-patched-device"],"who_is_affected":"Affects Android devices with the MediaQualityService component; exposure depends on the device build and its security patch level. The sources do not say which Android versions or manufacturers are affected. Only local code on the device can trigger it, so a device with no untrusted apps installed is at lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":4088,"output_tokens":506,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-58969':13A,16A 'addit':82C 'android':1A,17B,23B 'app':7A 'attack':40B 'block':35B 'bypass':66C 'check':5A,29B,72C 'code':31B 'could':74C 'cve':11A,14A 'data':9A 'devic':43B 'disclosur':47B,79C 'due':67C 'execut':50B,83C 'exploit':92C 'extra':49B 'function':21B,58C 'get':44B 'inform':46B,78C 'interact':55B,87C 'lack':26B 'lead':75C 'let':6A 'local':10A,45B,77C 'mediaqualityservic':2A 'mediaqualityservice.java':25B,60C 'miss':3A,70C 'mobil':18B 'multipl':57C 'need':85C,90C 'permiss':4A,28B,65C,71C 'possibl':64C 'privileg':51B,84C 'read':8A 'run':37B 'runtim':19B 'sever':20B 'user':54B,86C 'without':48B,53B","nicknames":[],"mitigations":[],"who_affected":"Affects Android devices with the MediaQualityService component; exposure depends on the device build and its security patch level. The sources do not say which Android versions or manufacturers are affected. Only local code on the device can trigger it, so a device with no untrusted apps installed is at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Install the latest Android system update on your phone once your manufacturer releases it.","pkeys":[],"ptokens":[],"labels":["android","mobile","runtime","unknown"],"first_public_at":"2026-11-02T20:17:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58969","severity":null,"published_at":"2026-11-02T20:17:53+00:00","modified_at":"2026-11-02T20:17:53+00:00","first_seen_at":"2026-11-02T20:35:34+00:00","fetched_at":"2026-11-02T20:35:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}