CVE-2026-49906
android.car.permission.CAR_DISPLAY_IN_CLUSTER permission by registering an…An unprivileged application can bypass the android.car.permission.CAR_DISPLAY_IN_CLUSTER permission by registering an activity with the android.car.cluster.NAVIGATION category and requesting navigation app focus. The privileged ClusterHomeSample application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
The sources do not list affected products or versions for this vulnerability yet.
0.1%2nd percentile
Bar shows rank among all scored CVEs.
Published
First publication at the source
Last modified
Latest change at the source
Collected
First seen by Baba Yaga Security