What is CVE-2026-58957 and how does it work?
CVE-2026-58957 is a security flaw identified in the resolveToHeavyWeightSwitcherIfNeeded function of ActivityStarter.java. This issue allows a background activity launch driven by a confused deputy mechanism.
The vulnerability has been documented by official tracking entities like source.android.com and is comparable in severity to other local privilege escalation flaws such as CVE-2026-58946: Vulnerabilidad Crítica CVSS 8.4 de Escalada de Privilegios. Similarly, ecosystem developments are heavily scrutinized, mirroring research seen in Vulnerabilidad crítica CVE-2026-115905 con CVSS 10.0 en la librería zip de Rust.
Who is affected and what are the security risks?
The primary risk associated with this vulnerability is a local escalation of privilege that does not require any additional execution privileges. Furthermore, exploitation does not depend on user interaction, making unauthorized background activities easier to trigger if unpatched.
The issue is detailed on https://nvd.nist.gov/vuln/detail/CVE-2026-58957 and https://www.cve.org/CVERecord?id=CVE-2026-58957 as a high-severity threat with a CVSS base score of 8.4 under vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How do I protect my system against this vulnerability?
Mitigating high-severity local vulnerabilities requires careful monitoring of vendor security updates and applying system patches immediately. Administrators should follow standard hardening guidelines to minimize local attack surfaces.
- Check official vendor advisories for available system updates.
- Apply the latest security patches provided by the platform maintainers.
- Audit local application permissions and restrict background activity launches where possible.