CVE-2026-58930

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI.

Android

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element.

2. Nov 2026

Ausgewertete Quellen

• Android
  https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01
• NVD
  CVE-2026-58930