{"id":"ASB-A-494816520","details":"In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-494816520","CVE-2026-58866"],"modified":"2026-11-02T16:56:18.231316825Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java","function":"setAccessibilityWindowAttributes"},"deprecated":false,"digest":{"function_hash":"319706674090344144939008815701665105604","length":378},"id":"ASB-A-494816520-26853691","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/69a79cb864f32857551e9136ce7108851905e006"},{"id":"ASB-A-494816520-382c0b5f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/69a79cb864f32857551e9136ce7108851905e006","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["217980531311019090734429633640303734046","68741872064083167940658700558191218017","98078994255493298976798976060403707768","162140218980256425254110902192299393812","7474240321895449813703930770124389380","73960224587453101053839561796378423800","128240184502810986844828742580073358223","242337800073271855722835476679524905046","222066037001459442955344097280258097427","327299883041021120488882912285211478183","10400758185695711528037182052583211734","44832381617186141360758147809147506336"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4e8436fb52f7ea38de23d648dc7a6522bf85ada","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java","function":"setAccessibilityWindowAttributes"},"deprecated":false,"digest":{"function_hash":"257773990650173923165940889237197306438","length":600},"id":"ASB-A-494816520-b01ff718"},{"deprecated":false,"digest":{"line_hashes":["167073875716824428784932562286258925199","184572066607556284495911827325818566087","217130234232790505028403097399995170265","98051424859740618327818129433403322705"],"threshold":0.9},"id":"ASB-A-494816520-bf84cbf2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4e8436fb52f7ea38de23d648dc7a6522bf85ada","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/69a79cb864f32857551e9136ce7108851905e006","https://android.googlesource.com/platform/frameworks/base/+/9e458ec2c588eadd795021f9e86d399cad4a61aa","https://android.googlesource.com/platform/frameworks/base/+/e4e8436fb52f7ea38de23d648dc7a6522bf85ada"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-494816520-20ea0086","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c7764051a1f052234f243a3081a047e53e3755ff","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["217980531311019090734429633640303734046","68741872064083167940658700558191218017","98078994255493298976798976060403707768","162140218980256425254110902192299393812","7474240321895449813703930770124389380","73960224587453101053839561796378423800","128240184502810986844828742580073358223","242337800073271855722835476679524905046","222066037001459442955344097280258097427","327299883041021120488882912285211478183","10400758185695711528037182052583211734","44832381617186141360758147809147506336"]}},{"id":"ASB-A-494816520-f5dc579a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c7764051a1f052234f243a3081a047e53e3755ff","target":{"function":"setAccessibilityWindowAttributes","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"},"deprecated":false,"digest":{"function_hash":"319706674090344144939008815701665105604","length":378}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c7764051a1f052234f243a3081a047e53e3755ff"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-494816520-df83847d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a96f9327b4c0ee74df6c3deb3577b1e39363775","target":{"function":"setAccessibilityWindowAttributes","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"},"deprecated":false,"digest":{"length":378,"function_hash":"319706674090344144939008815701665105604"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a96f9327b4c0ee74df6c3deb3577b1e39363775","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["217980531311019090734429633640303734046","68741872064083167940658700558191218017","98078994255493298976798976060403707768","162140218980256425254110902192299393812","7474240321895449813703930770124389380","73960224587453101053839561796378423800","128240184502810986844828742580073358223","242337800073271855722835476679524905046","222066037001459442955344097280258097427","327299883041021120488882912285211478183","10400758185695711528037182052583211734","44832381617186141360758147809147506336"]},"id":"ASB-A-494816520-f3894121"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8a96f9327b4c0ee74df6c3deb3577b1e39363775"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/934e642d37093708c4c801f9f86d6ffce81c0fd2"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"},"deprecated":false,"digest":{"line_hashes":["217980531311019090734429633640303734046","68741872064083167940658700558191218017","98078994255493298976798976060403707768","162140218980256425254110902192299393812","7474240321895449813703930770124389380","73960224587453101053839561796378423800","128240184502810986844828742580073358223","242337800073271855722835476679524905046","222066037001459442955344097280258097427","327299883041021120488882912285211478183","10400758185695711528037182052583211734","44832381617186141360758147809147506336"],"threshold":0.9},"id":"ASB-A-494816520-a55f01a3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/934e642d37093708c4c801f9f86d6ffce81c0fd2"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/934e642d37093708c4c801f9f86d6ffce81c0fd2","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java","function":"setAccessibilityWindowAttributes"},"deprecated":false,"digest":{"length":378,"function_hash":"319706674090344144939008815701665105604"},"id":"ASB-A-494816520-f175738e","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5f412bc43e7a0b0171ff825fa7f38b04a35b30ce","target":{"function":"setAccessibilityWindowAttributes","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"},"deprecated":false,"digest":{"function_hash":"319706674090344144939008815701665105604","length":378},"id":"ASB-A-494816520-4ac35a12"},{"digest":{"line_hashes":["217980531311019090734429633640303734046","68741872064083167940658700558191218017","98078994255493298976798976060403707768","162140218980256425254110902192299393812","7474240321895449813703930770124389380","73960224587453101053839561796378423800","128240184502810986844828742580073358223","242337800073271855722835476679524905046","222066037001459442955344097280258097427","327299883041021120488882912285211478183","10400758185695711528037182052583211734","44832381617186141360758147809147506336"],"threshold":0.9},"id":"ASB-A-494816520-c3922008","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5f412bc43e7a0b0171ff825fa7f38b04a35b30ce","target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5f412bc43e7a0b0171ff825fa7f38b04a35b30ce"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"319706674090344144939008815701665105604","length":378},"id":"ASB-A-494816520-14f18eea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/023a6ddaf0dfc4af599023f2f44817b8053a8e01","target":{"function":"setAccessibilityWindowAttributes","file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"}},{"target":{"file":"services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"},"deprecated":false,"digest":{"line_hashes":["217980531311019090734429633640303734046","68741872064083167940658700558191218017","98078994255493298976798976060403707768","162140218980256425254110902192299393812","7474240321895449813703930770124389380","73960224587453101053839561796378423800","128240184502810986844828742580073358223","242337800073271855722835476679524905046","222066037001459442955344097280258097427","327299883041021120488882912285211478183","10400758185695711528037182052583211734","44832381617186141360758147809147506336"],"threshold":0.9},"id":"ASB-A-494816520-ea062818","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/023a6ddaf0dfc4af599023f2f44817b8053a8e01"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/023a6ddaf0dfc4af599023f2f44817b8053a8e01"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"}}],"schema_version":"1.9.2"}