Google Android: Permission bypass leading to local privilege escalation
Summary
A logic error in the Android Framework allows a permission check to be bypassed. A local attacker with a foothold on the device, for example through a malicious or compromised app with low privileges, can escalate privileges. No user interaction is required. The flaw is not internet-facing, but it matters most for unpatched phones and tablets that hold business data or accounts.
Affected
- Android 14, 15, 16, 16-qpr2 and 17 (AOSP versions per Google's bulletin)
- Component: Framework
- CVSS 3.1: 7.8 (High), AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fixed in
- Security patch level 2026-10-01 or later
- OEM builds: the fixed version varies by vendor. Samsung reportedly ships the fix in "SMR Oct-2026 Release 1" (secondary source, not verified with Samsung)
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found.
- Not marked as exploited in Google's October 2026 bulletin.
- No public proof of concept found.
Our recommendation
- Inventory all Android devices and check that the security patch level is 2026-10-01 or later.
- For Samsung and other OEM devices, confirm the vendor build with the fix, not only the patch level.
- Enforce updates via MDM and isolate or replace devices that cannot be updated.
- Keep this issue in the same patch cycle as other High and Critical Android items.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin, October 2026 source.android.com
- CVE-2026-58841 at Threatint cve.threatint.com
- PT-2026-106160 at Vulners vulners.com
- CVE-2026-58841 at Strix www.strix.ai
- Canadian Cyber Centre: Android October 2026 monthly rollup advisory www.cyber.gc.ca
- Samsung October 2026 security patch release notes (secondary) www.sammyfans.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:27.
Original description (NVD)
In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.