CVE-2026-58879

HighCVSS 8.4/10Last modified Nov 10, 2026

Description

In descramble of multiple files, there is a possible out-of-bounds write due to improper casting. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Google	Android	17; 16-qpr2; 16; 15; 14

References

https://source.android.com/docs/security/bulletin/2026/2026-11-01

Timeline

Published: Nov 2, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-58886.5Uninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information CVE-2026-588807.0In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to loca CVE-2026-588827.5In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denia CVE-2026-588837.5In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service w CVE-2026-588848.4In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to l CVE-2026-588858.4In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with CVE-2026-588867.8In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This could lead to local CVE-2026-58894.3Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encr CVE-2026-58905.3Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process CVE-2026-58914.3Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the rend CVE-2026-589156.1A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notific CVE-2026-58926.6Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer p