Live › vulnerability › CVE-2026-59002
A logic error in the USB device manager code of Android's UsbDeviceManager.java lets a person with physical access bypass the lock screen. An attacker can see information on a locked phone without unlocking it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Android devices whose security patch level predates the fix; the sources do not name the affected versions or the patched build. Devices with a locked screen and a physically present attacker are the exposure. Teams that manage company phones should check patch levels, and anyone with fully updated devices can skip it.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-59002")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.