Android XR missing permission check allows privilege escalation
On Android XR devices, an app can take permissions it should not have.
Summary
A missing permission check in the WindowManagerService of Android XR lets a local app gain permissions it should not have. No user interaction is needed to exploit it.
What to do
Install an update with security patch level 2026-11-01 or later; contact your device supplier for firmware.
Products and platforms
CVE IDs
Sources
- Advisory: source.android.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen