In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission

Google Android2026-11-02 20:17 UTC1 min readRead in

Summary

In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Remediation

Inventory every Google Android deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Referencehttps://source.android.com/docs/security/bulletin/2026/2026-11-01

CVSS vector

Attack vector: Local
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
17	None yet
16-qpr2	None yet
16	None yet
15	None yet
14	None yet

Weakness

CWE-862

Timeline

2026-11-02Publicly disclosed

Sources

NVD · CVE