Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

Android notification manager may let apps gain extra rights

CVE-2026-55262 · published 4 days ago
Summary

The Android system component that controls notification settings can be tricked into thinking a user has granted permission when they have not. This mistake could allow a malicious app on the device to obtain higher privileges without the user’s knowledge. Update the device to the latest Android version or apply any available security patches to fix the issue.

What to do
  • Update google platform/frameworks/base to version 17-qpr2-next:2026-11-01.
  • Update google platform/frameworks/base to version 15:2026-11-01.
  • Update google platform/frameworks/base to version 16:2026-11-01.
  • Update google platform/frameworks/base to version 16-qpr2:2026-11-01.
  • Update google platform/frameworks/base to version 17:2026-11-01.
  • Update google platform/frameworks/base to version 14:2026-11-01.
Affected software
Ecosystem VendorProductAffected versions
– google android 17
Android google platform/frameworks/base >= 17-qpr2-next:0, < 17-qpr2-next:2026-11-01
>= 15:0, < 15:2026-11-01
>= 16:0, < 16:2026-11-01
>= 16-qpr2:0, < 16-qpr2:2026-11-01
>= 17:0, < 17:2026-11-01
>= 14:0, < 14:2026-11-01
Fix: upgrade to 17-qpr2-next:2026-11-01
Original advisory text
In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation. This could lead to local e...
In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published1 Nov 2026
Updated4 Nov 2026
First seen2 Nov 2026
Sources
CVE-2026-55262 · NVD
CVE-2026-55262 · MITRE
ASB-A-505067993 · OSV
Track software like this
Free during beta