CVE-2026-58961

HighCVSS 8.4/10Last modified Nov 10, 2026

Description

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Google	Android	17; 16-qpr2; 16; 15; 14

References

https://source.android.com/docs/security/bulletin/2026/2026-11-01

Timeline

Published: Nov 2, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-589628.4In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check. This c CVE-2026-589637.5In multiple locations, there is a possible denial of service due to improper input validation. This could lead to remote denial of service w CVE-2026-589648.4In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. This could lead to loca CVE-2026-589658.4In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to loca CVE-2026-589668.4In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This could lead to local esca CVE-2026-589689.8In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of pri CVE-2026-589694.0In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead CVE-2026-58974.3Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in speci CVE-2026-589708.4In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local e CVE-2026-589714.0In _mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow. This could lead to local information CVE-2026-589748.4In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privi CVE-2026-589758.4In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privile