PT-2026-135800

CVE-2026-49906

·

Published

2026-11-02

·

Updated

2026-11-02

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

An unprivileged application can bypass the android.car.permission.CAR DISPLAY IN CLUSTER permission by registering an activity with the android.car.cluster.NAVIGATION category and requesting navigation app focus. The privileged ClusterHomeSample application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.
Vendors
Affected products
Related identifiers
CVE-2026-49906
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com