Live › vulnerability › CVE-2026-58989
A missing permission check in the Android OemLockService setOemUnlockAllowedByUser function lets a local process bypass Factory Reset Protection. The sources say it leads to local privilege escalation with no extra execution privileges and no user interaction.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Android devices with the OemLockService component are affected; the sources do not name affected Android versions or builds. Devices kept on current security updates may already be patched. Servers, containers and other non-Android systems are not affected.
No product ranges from the sources yet.
getprop ro.build.version.security_patchNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-58989")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.