CVE-2026-49906: High severity vulnerability

Published Nov 2, 2026

Updated

An unprivileged application can bypass the android.car.permission.CARDISPLAYINCLUSTER permission by registering an activity with the android.car.cluster.NAVIGATION category and requesting navigation app focus. The privileged ClusterHomeSample application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.

Event History

Nov 2, 2026

CVE Published

via MITRE·08:21 PM

Data Sourced

via MITRE·08:21 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs to install or run an unprivileged application on the device. That application can register an activity with the android.car.cluster.NAVIGATION category and request navigation app focus.

Which component acts as the confused deputy?

The privileged ClusterHomeSample application resolves and launches the third-party activity. It does so without enforcing the android.car.permission.CAR_DISPLAY_IN_CLUSTER permission check.

What is the practical impact of successful exploitation?

An attacker can cause arbitrary third-party content to be displayed persistently on the safety-critical instrument cluster display. The content may be misleading or distracting.

CVE-2026-49906: High severity vulnerability

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which component acts as the confused deputy?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which component acts as the confused deputy?

What is the practical impact of successful exploitation?