CVE-2026-58915 in Android
Summary
by MITRE • 11/02/2026
A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability described represents a critical authentication bypass within the Android Automotive OS Multi-User Multi-Display architecture, specifically targeting the Heads-Up Notification system on passenger displays. In modern automotive infotainment systems, security models often rely on distinct keyguard states for different users to ensure that sensitive data and actions are protected by appropriate credentials. However, in this scenario, the implementation of the PassengerKeyguard fails to properly isolate notification visibility from the driver's session state. The core technical flaw lies in the fact that the Heads-Up Notification system checks only the global keyguard state rather than evaluating the specific security context of the current user or display. Since the global keyguard is typically tied to the primary driver’s unlocked status, any passenger who has physical access to their own multi-user multi-display terminal can view sensitive notifications intended for a secure secondary user without providing authentication credentials.
This architectural oversight allows an attacker with physical presence in the vehicle to exploit the lack of per-user notification suppression mechanisms. When the driver unlocks their display, the global keyguard state transitions to unlocked, which inadvertently signals to the Heads-Up Notification system that it is safe to render all pending notifications across all displays connected to the system. Consequently, private data belonging to User N, such as personal messages, banking alerts, or health information, becomes visible on the passenger screen without any barrier. Furthermore, because the PassengerKeyguard implementation does not intercept action PendingIntents associated with these notifications, an attacker can also execute actions defined within those notifications. This means that beyond mere data disclosure, the vulnerability enables unauthorized command execution, such as sending messages, making calls, or accessing connected applications on behalf of User N.
From a classification perspective, this issue aligns closely with CWE-287, which describes Improper Authentication, specifically regarding the failure to verify identity before allowing access to sensitive resources. Additionally, it relates to CWE-601, URL Redirection to Untrusted Site, if the notifications involve external links that could be manipulated, but more accurately fits CWE-539, Information Exposure Through Debug Information or Logs, in terms of unintended data leakage through UI components. In the context of the MITRE ATT&CK framework for ICS and automotive environments, this vulnerability facilitates unauthorized access to system functions and can be categorized under techniques related to credential dumping or privilege escalation if the executed actions lead to higher-level permissions. It also reflects weaknesses in session management where the security state is not correctly bound to individual user contexts across multiple displays.
The operational impact of this flaw extends beyond simple privacy violations. By allowing unauthorized execution of PendingIntents, an attacker could potentially trigger automated responses that interact with vehicle systems or external services linked to User N’s account. This compromises the integrity and confidentiality guarantees expected in a multi-user automotive environment. For manufacturers and developers, mitigating this vulnerability requires a fundamental redesign of how notification visibility is managed across different displays and users. The system must enforce strict per-user keyguard checks when rendering Heads-Up Notifications on secondary displays, ensuring that even if the global state indicates an unlocked driver session, passenger notifications remain suppressed until User N authenticates themselves locally on their specific display. Implementing proper interception of action PendingIntents at the user-specific level is also essential to prevent unauthorized command execution. Regular security audits focusing on multi-user isolation and cross-display data flow are recommended to identify similar architectural weaknesses in automotive software stacks.