CVE-2026-58877 in Android
Summary
by MITRE • 11/02/2026
In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in the Android framework component WifiP2pServiceImpl.java represents a classic confused deputy scenario within the checkNearbyDevicesPermission logic. In this context, the system fails to properly verify that the calling application possesses the necessary permissions before granting access to sensitive device discovery data. A confused deputy occurs when an unprivileged entity exploits its relationship with a privileged process or service to perform actions it is not authorized to do. Here, while the WifiP2pService itself operates with elevated privileges required for managing Wi-Fi Direct connections, the permission check mechanism does not adequately isolate the context of the caller. This allows any application installed on the device, regardless of its own declared permissions, to invoke methods that trigger this service and retrieve information about nearby devices without being blocked by the security manager.
The technical flaw lies in the implementation details of how the system validates access rights during peer discovery operations. When an application requests a list of nearby Wi-Fi Direct peers, the framework is supposed to ensure that the requesting app has explicitly declared the android.permission.NEARBY_DEVICES permission and received user approval for it on newer Android versions or satisfied legacy requirements depending on the OS version. However, due to this implementation oversight, the service proceeds with the operation without enforcing these constraints strictly enough in all code paths. This bypass effectively neutralizes the intended security boundary between applications, allowing one app to act as a proxy for another that lacks proper authorization. The flaw is particularly insidious because it does not require complex exploitation techniques or specific system states beyond having an application installed on the target device.
The operational impact of this vulnerability centers on local information disclosure with significant privacy implications. An attacker can exploit this weakness to enumerate nearby devices, gathering details such as device names, MAC addresses, and potentially other identifiers associated with Wi-Fi Direct peers. This data is critical for building profiles of users or mapping out the network topology in a given physical location. Since no additional execution privileges are needed beyond standard application installation rights, the barrier to entry for an attacker is extremely low. Furthermore, because user interaction is not required during exploitation, this vulnerability can be triggered silently and automatically by malicious software running in the background. This makes it difficult for users to detect that their privacy is being compromised at any given moment.
From a classification perspective, this issue aligns with CWE-269 Improper Privilege Management, specifically where an actor obtains privileges without explicit authorization through a confused deputy pattern. It also relates closely to CWE-749 Exposure of Sensitive Information to an Unauthorized Actor, as the result is the leakage of device discovery data that should remain restricted. In terms of adversary tactics, this vulnerability supports reconnaissance activities within the MITRE ATT&CK framework, particularly techniques related to Device Discovery and Network Service Scanning on mobile platforms. Attackers can use such capabilities to identify potential targets for further exploitation or social engineering attacks based on the identified devices.
Mitigation strategies must focus on correcting the permission verification logic within the WifiP2pServiceImpl.java file. Developers need to ensure that every entry point into device discovery functions performs a rigorous check of the calling application's granted permissions against the required android.permission.NEARBY_DEVICES entitlement. This includes verifying not just the manifest declaration but also runtime grants where applicable, depending on the Android version being targeted. Additionally, implementing stricter context checks and ensuring that the service does not return sensitive peer information unless all security prerequisites are met will close this gap. For users of affected systems, applying the latest available platform updates is critical as these patches typically contain fixes for such framework-level permission bypasses. Until patched, restricting app permissions to minimum necessary levels can help reduce the attack surface by limiting which applications have access to location or network discovery features that might be leveraged in conjunction with this flaw.