CVE-2026-58859

HighCVSS 7.8/10Last modified Oct 7, 2026

Description

In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-248

Affected software

VendorProductVersions
GoogleAndroid17

References

Timeline

Published
Oct 5, 2026
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-58865.3Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive infoCVE-2026-588657.5In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to CVE-2026-588668.4In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing pCVE-2026-588678.4In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to locaCVE-2026-588689.8In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote coCVE-2026-58874.3Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypaCVE-2026-588704.0In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This couldCVE-2026-588718.4In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to loCVE-2026-588738.4In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could leaCVE-2026-588747.8In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead CVE-2026-588756.2In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service wiCVE-2026-588769.8In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no add
CVE-2026-58859: High severity, CVSS 7.8 | Vulnix