What is CVE-2026-58979 and how does it affect Android?

CVE-2026-58979 is a critical security vulnerability discovered in the Android operating system, specifically tied to a logic flaw within internal platform components. Similar to issues found in escalada local en ActivityClientController, security researchers identified severe architecture flaws. The vulnerability exists within the canPresent function of PresentationController.java, where improper logic handling leads directly to a permission bypass.

Rated with a high CVSS score of 8.4, this security gap falls under the CWE-693 classification. It exposes systems to local privilege escalation risks without demanding any additional execution privileges or interaction from the user during exploitation.

Who is affected by this permission bypass vulnerability?

This security flaw impacts local execution environments across compatible Android builds where the vulnerable PresentationController component resides. Similar to the risks analyzed in vulnerabilidad crítica en ActivityStarter, attackers do not need prior execution privileges to leverage this flaw. Furthermore, zero user interaction is required to successfully execute the bypass.

The combination of high severity and local access requirements makes local applications potentially capable of escalating their privileges maliciously. This issue shares risk patterns with other recent flaws such as vulnerabilidad use-after-free con CVSS 8.4, which also target core system components.

How can I protect my system against this vulnerability?

Mitigating this critical security issue requires applying the official software updates and patches provided by the vendor. You can review the technical details directly through the Referencia técnica en source.android.com and official entries at CVE-2026-58979 en CVE.org.

Ensure your devices receive timely updates by following these recommended protection steps:

  1. Verify the current security patch level on your targeted Android devices.
  2. Check the official Android security bulletin for device-specific updates.
  3. Apply the latest system firmware containing the fix for PresentationController.java.
  4. Restrict untrusted local application installations to minimize potential exposure vectors.