CVE WATCH / VULNERABILITY DETAIL
CVE-2026-49903
UNKNOWNCVSS 0NVD feed
Published 2 November 2026 · tracked since 3 November 2026
Description
The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-58925
- CVE-2026-58915
- CVE-2026-49906 HIGH 7.8
- CVE-2026-59042 HIGH 7.4
- CVE-2026-59046
- CVE-2026-59006
- CVE-2026-58985
- CVE-2026-58886
- CVE-2026-58934 HIGH 8.4
- CVE-2026-58866 HIGH 8.4