CVE-2026-58915

Received Received - Intake

Physical HUN Bypass in Android Automotive OS

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description

A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-02

Last Modified

2026-11-02

Generated

2026-11-03

AI Q&A

2026-11-03

EPSS Evaluated

N/A

NVD

CVE-2026-58915

Affected Vendors & Products

Vendor	Product	Version / Range
Google	Android	17
Google	Android	16-qpr2
Google	Android	16
Google	Android	15
Google	Android	14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability allows a physical occupant on an Android Automotive OS Multi-User Multi-Display passenger display to view sensitive Heads-Up Notifications (HUN) and execute actions for a secure passenger user without authentication. The issue occurs because the HUN system only checks the global keyguard state tied to the driver's unlocked display, and the PassengerKeyguard fails to suppress HUNs or block action PendingIntents.

Impact Analysis

An attacker with physical access to the passenger display could view private notifications or perform actions on behalf of another user without their credentials. This could lead to unauthorized access to sensitive data or control over the vehicle's systems.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing private user data without authentication. Unauthorized access to sensitive information may result in non-compliance with privacy and security requirements.

Mitigation Strategies

Disable or restrict multi-user functionality on Android Automotive OS systems. Ensure PassengerKeyguard is properly configured to suppress Heads-Up Notifications for secure users. Update to the latest Android Automotive OS version if a patch is available.

Hi! I’m here to help you understand CVE-2026-58915. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...