CVE-2026-49903: Security vulnerability

Published Nov 2, 2026

Updated

The ClusterRenderingService.dump() method, accessible to processes holding android.permission.DUMP and android.permission.PACKAGEUSAGESTATS, acts as a confused deputy. It allows attackers to write arbitrary values to Settings.Global.OVERLAYDISPLAYDEVICES, an operation normally requiring android.permission.WRITESECURESETTINGS, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.

Event History

Nov 2, 2026

CVE Published

via NVD·09:17 PM

Data Sourced

via NVD·09:17 PM

Description

Frequently Asked Questions

What permissions does an attacker need to exploit this issue?

The attacking process must hold both android.permission.DUMP and android.permission.PACKAGE_USAGE_STATS. It does not need android.permission.WRITE_SECURE_SETTINGS because the vulnerable service performs the protected settings write on its behalf.

What impact can successful exploitation have?

An attacker can write arbitrary values to Settings.Global.OVERLAY_DISPLAY_DEVICES, allowing persistent creation of system overlay displays. The issue can also enable injection of key events into the cluster UI.

How can defenders determine whether they may be exposed?

Review processes that hold both android.permission.DUMP and android.permission.PACKAGE_USAGE_STATS, and determine whether untrusted or insufficiently isolated code can run in those processes. Also inspect the OVERLAY_DISPLAY_DEVICES global setting for unexpected values or overlay-display configurations.

CVE-2026-49903: Security vulnerability

Event History

Frequently Asked Questions

What permissions does an attacker need to exploit this issue?

What impact can successful exploitation have?

How can defenders determine whether they may be exposed?

Company

Resources

Contact

Frequently Asked Questions

What permissions does an attacker need to exploit this issue?

What impact can successful exploitation have?

How can defenders determine whether they may be exposed?