CVE-2026-58877: Medium severity Google Android vulnerability

Q: What access does an attacker need to exploit this issue?

Exploitation requires local access. No additional execution privileges or user interaction are needed.

Q: Which component should be prioritized for review?

The affected component is the Android Wi-Fi module, specifically WifiP2pServiceImpl.java and its checkNearbyDevicesPermission handling.

Published Nov 1, 2026

Updated

In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

7 affected componentsFixes available

android/platform/packages/modules/wifi>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/packages/modules/wifi>=15:0<15:2026-11-01

15:2026-11-01

android/platform/packages/modules/wifi>=16:0<16:2026-11-01

16:2026-11-01

android/platform/packages/modules/wifi>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/packages/modules/wifi>=17:0<17:2026-11-01

17:2026-11-01

android/platform/packages/modules/wifi>=14:0<14:2026-11-01

14:2026-11-01

Google Android

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade android/platform/packages/modules/Wifi to a version that resolves this vulnerability.
Fixed in 17-qpr2-next:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/Wifi to a version that resolves this vulnerability.
Fixed in 15:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/Wifi to a version that resolves this vulnerability.
Fixed in 16:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/Wifi to a version that resolves this vulnerability.
Fixed in 16-qpr2:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/Wifi to a version that resolves this vulnerability.
Fixed in 17:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/Wifi to a version that resolves this vulnerability.
Fixed in 14:2026-11-01

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

Description

Data Sourced

via NVD·08:17 PM

SeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Exploitation requires local access. No additional execution privileges or user interaction are needed.

Which component should be prioritized for review?

The affected component is the Android Wi-Fi module, specifically WifiP2pServiceImpl.java and its checkNearbyDevicesPermission handling.

CVE-2026-58877: Medium severity Google Android vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which component should be prioritized for review?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which component should be prioritized for review?