Loading vulnerability…
Android Permission Bypass Leading to Local Information Disclosure
CVE-2026-58951 is a high-severity Android vulnerability caused by missing permission checks in multiple locations. These omissions allow a local attacker to bypass permission restrictions and access otherwise protected information without additional execution privileges or user interaction. The affected functions, specific information exposed, and CVE-specific affected versions are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises confidentiality by exposing information that should be protected by Android permission checks. The scope and sensitivity of the accessible information are unspecified. Code execution, privilege escalation, and availability impacts are not established for this vulnerability.
Patch, then assume compromise.
Install the applicable November 2026 Android security update supplied by the device manufacturer. For affected Samsung Galaxy devices, apply the applicable November 2026 Security Maintenance Release. Consult the vendor security bulletin for device-specific applicability and verify the installed security patch level after updating. Exact fixed builds and the minimum patch level for this CVE are not specified.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.