{"id":"ASB-A-494816520", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58866", "A-494816520"], "details":"In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/69a79cb864f32857551e9136ce7108851905e006", "https://android.googlesource.com/platform/frameworks/base/+/9e458ec2c588eadd795021f9e86d399cad4a61aa", "https://android.googlesource.com/platform/frameworks/base/+/e4e8436fb52f7ea38de23d648dc7a6522bf85ada"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"319706674090344144939008815701665105604", "length":378}, "id":"ASB-A-494816520-26853691", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/69a79cb864f32857551e9136ce7108851905e006", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java", "function":"setAccessibilityWindowAttributes"}}, {"deprecated":false, "digest":{"line_hashes":["217980531311019090734429633640303734046", "68741872064083167940658700558191218017", "98078994255493298976798976060403707768", "162140218980256425254110902192299393812", "7474240321895449813703930770124389380", "73960224587453101053839561796378423800", "128240184502810986844828742580073358223", "242337800073271855722835476679524905046", "222066037001459442955344097280258097427", "327299883041021120488882912285211478183", "10400758185695711528037182052583211734", "44832381617186141360758147809147506336"], "threshold":0.9}, "id":"ASB-A-494816520-382c0b5f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/69a79cb864f32857551e9136ce7108851905e006", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"}}, {"deprecated":false, "digest":{"function_hash":"257773990650173923165940889237197306438", "length":600}, "id":"ASB-A-494816520-b01ff718", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e4e8436fb52f7ea38de23d648dc7a6522bf85ada", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java", "function":"setAccessibilityWindowAttributes"}}, {"deprecated":false, "digest":{"line_hashes":["167073875716824428784932562286258925199", "184572066607556284495911827325818566087", "217130234232790505028403097399995170265", "98051424859740618327818129433403322705"], "threshold":0.9}, "id":"ASB-A-494816520-bf84cbf2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e4e8436fb52f7ea38de23d648dc7a6522bf85ada", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c7764051a1f052234f243a3081a047e53e3755ff"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["217980531311019090734429633640303734046", "68741872064083167940658700558191218017", "98078994255493298976798976060403707768", "162140218980256425254110902192299393812", "7474240321895449813703930770124389380", "73960224587453101053839561796378423800", "128240184502810986844828742580073358223", "242337800073271855722835476679524905046", "222066037001459442955344097280258097427", "327299883041021120488882912285211478183", "10400758185695711528037182052583211734", "44832381617186141360758147809147506336"], "threshold":0.9}, "id":"ASB-A-494816520-20ea0086", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c7764051a1f052234f243a3081a047e53e3755ff", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"}}, {"deprecated":false, "digest":{"function_hash":"319706674090344144939008815701665105604", "length":378}, "id":"ASB-A-494816520-f5dc579a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c7764051a1f052234f243a3081a047e53e3755ff", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java", "function":"setAccessibilityWindowAttributes"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8a96f9327b4c0ee74df6c3deb3577b1e39363775"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"319706674090344144939008815701665105604", "length":378}, "id":"ASB-A-494816520-df83847d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8a96f9327b4c0ee74df6c3deb3577b1e39363775", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java", "function":"setAccessibilityWindowAttributes"}}, {"deprecated":false, "digest":{"line_hashes":["217980531311019090734429633640303734046", "68741872064083167940658700558191218017", "98078994255493298976798976060403707768", "162140218980256425254110902192299393812", "7474240321895449813703930770124389380", "73960224587453101053839561796378423800", "128240184502810986844828742580073358223", "242337800073271855722835476679524905046", "222066037001459442955344097280258097427", "327299883041021120488882912285211478183", "10400758185695711528037182052583211734", "44832381617186141360758147809147506336"], "threshold":0.9}, "id":"ASB-A-494816520-f3894121", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8a96f9327b4c0ee74df6c3deb3577b1e39363775", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/934e642d37093708c4c801f9f86d6ffce81c0fd2"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["217980531311019090734429633640303734046", "68741872064083167940658700558191218017", "98078994255493298976798976060403707768", "162140218980256425254110902192299393812", "7474240321895449813703930770124389380", "73960224587453101053839561796378423800", "128240184502810986844828742580073358223", "242337800073271855722835476679524905046", "222066037001459442955344097280258097427", "327299883041021120488882912285211478183", "10400758185695711528037182052583211734", "44832381617186141360758147809147506336"], "threshold":0.9}, "id":"ASB-A-494816520-a55f01a3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/934e642d37093708c4c801f9f86d6ffce81c0fd2", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"}}, {"deprecated":false, "digest":{"function_hash":"319706674090344144939008815701665105604", "length":378}, "id":"ASB-A-494816520-f175738e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/934e642d37093708c4c801f9f86d6ffce81c0fd2", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java", "function":"setAccessibilityWindowAttributes"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5f412bc43e7a0b0171ff825fa7f38b04a35b30ce"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"319706674090344144939008815701665105604", "length":378}, "id":"ASB-A-494816520-4ac35a12", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5f412bc43e7a0b0171ff825fa7f38b04a35b30ce", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java", "function":"setAccessibilityWindowAttributes"}}, {"deprecated":false, "digest":{"line_hashes":["217980531311019090734429633640303734046", "68741872064083167940658700558191218017", "98078994255493298976798976060403707768", "162140218980256425254110902192299393812", "7474240321895449813703930770124389380", "73960224587453101053839561796378423800", "128240184502810986844828742580073358223", "242337800073271855722835476679524905046", "222066037001459442955344097280258097427", "327299883041021120488882912285211478183", "10400758185695711528037182052583211734", "44832381617186141360758147809147506336"], "threshold":0.9}, "id":"ASB-A-494816520-c3922008", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5f412bc43e7a0b0171ff825fa7f38b04a35b30ce", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/023a6ddaf0dfc4af599023f2f44817b8053a8e01"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"319706674090344144939008815701665105604", "length":378}, "id":"ASB-A-494816520-14f18eea", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/023a6ddaf0dfc4af599023f2f44817b8053a8e01", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java", "function":"setAccessibilityWindowAttributes"}}, {"deprecated":false, "digest":{"line_hashes":["217980531311019090734429633640303734046", "68741872064083167940658700558191218017", "98078994255493298976798976060403707768", "162140218980256425254110902192299393812", "7474240321895449813703930770124389380", "73960224587453101053839561796378423800", "128240184502810986844828742580073358223", "242337800073271855722835476679524905046", "222066037001459442955344097280258097427", "327299883041021120488882912285211478183", "10400758185695711528037182052583211734", "44832381617186141360758147809147506336"], "threshold":0.9}, "id":"ASB-A-494816520-ea062818", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/023a6ddaf0dfc4af599023f2f44817b8053a8e01", "target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}