CVE WATCH / VULNERABILITY DETAIL
CVE-2026-49906
HIGHCVSS 7.8NVD feed
Published 2 November 2026 · tracked since 3 November 2026
Description
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolv
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog