Unrated severityNVD Advisory· Published Nov 2, 2026
CVE-2026-49903
CVE-2026-49903
Description
The ClusterRenderingService.dump() method, accessible to processes holding android.permission.DUMP and android.permission.PACKAGE_USAGE_STATS, acts as a confused deputy. It allows attackers to write arbitrary values to Settings.Global.OVERLAY_DISPLAY_DEVICES, an operation normally requiring android.permission.WRITE_SECURE_SETTINGS, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.