CVE-2026-49883Medium· 5.5▾ SunlitIn checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
10 → 5.5
critical → medium
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
android = 14.0android = 16.0android = 17.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-58846High· 7.8In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check
CVE-2026-58874High· 7.8In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check
CVE-2026-28656High· 7.3In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack
CVE-2026-0009High· 7.8In multiple locations, there is a possible tapjacking due to a logic error in the code
CVE-2026-0091High· 7.8In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user
CVE-2026-0089High· 7.8In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check