CVE-2026-49883

CVE-2026-49883 is a missing permission check in the checkReadPermission function of PermissionsManager.java in Android, categorized as improper privilege management (CWE-269). An app or process on the device can trigger the flaw locally without requiring any additional execution privileges or user interaction, bypassing the permission gate that should protect sensitive device state data. A successful exploit results in local information disclosure, allowing the caller to read sensitive device state information it is not authorized to access. All Android devices running affected versions are potentially exposed, though the available data does not specify which Android version ranges are impacted, so the Android Security Bulletin should be consulted for affected versions and patches. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates only a 0.2% probability of exploitation within 30 days, despite the critical 10.0 CVSS 4.0 score assigned by Google's Android security team.

What to do: Monitor the Android Security Bulletin for CVE-2026-49883 and apply the corresponding monthly security update as soon as affected versions and fixed patch levels are published; users and administrators should check the installed Android security patch level (Settings > About phone > Android security update) and apply updates when a patch level containing the fix is available. Until devices are patched, limit installing untrusted or sideloaded apps, since exploitation requires a local app or process on the device.