CVE-2026-58702
Published Nov 10, 2026
CVSS n/a
EPSS < 1%
KEV · Not listed
Description
In createIntent of TimerAgent.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Android | unaffected |
|
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.126% probability within 30 days)
Key SSVC decision points have not yet been added.
References
History
Nov 12, 2026 8:15 PM
Title updated. Weaknesses updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Local Permission Bypass Leading to Information Disclosure in Android TimerAgent | |
| Weaknesses | CWE-755 |
Nov 12, 2026 2:45 AM
Title updated. Weaknesses updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Local Permission Bypass Leading to Information Disclosure in Android TimerAgent | |
| Weaknesses | CWE-755 |
Nov 10, 2026 7:30 PM
Description updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In createIntent of TimerAgent.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | |
| References |
|
Subscriptions
No data.
Weaknesses
No weakness.
