CVE-2026-49883

Analyzed Analyzed - Analysis Complete

PermissionsManager Missing Permission Check Leads to Local Info Disclosure

Publication date: 2026-09-08

Last updated on: 2026-09-14

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-14

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-49883

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	14.0
google	android	16.0
google	android	17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves a missing permission check in PermissionsManager.java's checkReadPermission function. It allows local monitoring of sensitive device state data without requiring additional execution privileges or user interaction.

Detection Guidance

This vulnerability involves a missing permission check in PermissionsManager.java that could expose sensitive device state data. Detection would require reviewing Android system logs for unauthorized access attempts to device state data or monitoring for unusual data collection patterns by applications.

Impact Analysis

An attacker could exploit this to access sensitive device state information locally, potentially leading to unauthorized data exposure or privacy breaches without needing special permissions.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive device state data, potentially leading to non-compliance with privacy requirements.

Mitigation Strategies

Apply the latest Android security patches immediately to address the missing permission check. Review installed applications for excessive permissions and revoke unnecessary ones. Monitor device logs for suspicious activity related to device state data access.

Hi! I’m here to help you understand CVE-2026-49883. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70