{"id":"CVE-2026-58989","kind":"vulnerability","aliases":["CVE-2026-58989"],"related":[],"title":"Android: missing permission check lets a local app bypass FRP lock","description":"In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A missing permission check in the Android OemLockService setOemUnlockAllowedByUser function lets a local process bypass Factory Reset Protection. The sources say it leads to local privilege escalation with no extra execution privileges and no user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","oem-devices","runtime"],"not_affected_if":["non-android"],"how_to_check":"- Check the device's Android security patch level in Settings > About phone > Android version, or `getprop ro.build.version.security_patch`","fix":null,"status":"open","published_at":"2026-11-02T20:17:54+00:00","first_seen_at":"2026-11-02T20:35:35+00:00","triaged_at":"2026-11-02T20:37:11+00:00","updated_at":"2026-11-02T20:37:11+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-02T20:37:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: missing permission check lets a local app bypass FRP lock","impact":"high","summary":"A missing permission check in the Android OemLockService setOemUnlockAllowedByUser function lets a local process bypass Factory Reset Protection. The sources say it leads to local privilege escalation with no extra execution privileges and no user interaction.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["android","mobile","oem-devices"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local app gains privileges and bypasses factory reset protection","analyst_note":"Find the Android Security Bulletin entry for CVE-2026-58989 to confirm affected Android versions and the patched patch level.","how_to_check":"- Check the device's Android security patch level in Settings > About phone > Android version, or `getprop ro.build.version.security_patch`\n- unknown for any other check, since the sources do not name affected builds","plain_action":"Install the latest Android security update on your phone and wait for the manufacturer to release it if none is available yet.","needs_analyst":true,"not_affected_if":["non-android"],"who_is_affected":"Android devices with the OemLockService component are affected; the sources do not name affected Android versions or builds. Devices kept on current security updates may already be patched. Servers, containers and other non-Android systems are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4108,"output_tokens":528,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-58989':14A,17A 'addit':88C 'android':1A,18B,30B 'app':8A 'bypass':9A,38B,70C 'check':4A,27B,77C 'could':79C 'cve':12A,15A 'devic':22B 'due':72C 'escal':50B,83C 'execut':54B,89C 'exploit':98C 'extra':53B 'factori':39B 'frp':10A,71C 'function':33B 'interact':59B,93C 'lead':46B,80C 'let':5A,34B 'local':7A,36B,48B,82C 'lock':11A 'miss':2A,25B,75C 'mobil':19B 'need':91C,96C 'oem':21B 'oem-devic':20B 'oemlockservic':31B 'oemlockservice.java':63C 'permiss':3A,26B,76C 'possibl':67C 'privileg':49B,55B,85C,90C 'process':37B 'protect':41B 'reset':40B 'runtim':23B 'say':44B 'setoemunlockallowedbyus':32B,61C 'sourc':43B 'user':58B,92C 'way':68C","nicknames":[],"mitigations":[],"who_affected":"Android devices with the OemLockService component are affected; the sources do not name affected Android versions or builds. Devices kept on current security updates may already be patched. Servers, containers and other non-Android systems are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","mobile","oemdevices","runtime","unknown"],"first_public_at":"2026-11-02T20:17:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58989","severity":null,"published_at":"2026-11-02T20:17:54+00:00","modified_at":"2026-11-02T20:17:54+00:00","first_seen_at":"2026-11-02T20:35:35+00:00","fetched_at":"2026-11-02T20:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}