CVE-2026-56888: android — Fix

Description

In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Is your site exposed to CVE-2026-56888?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.2

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploit Prediction

0.0010

Probability of exploitation

0.01%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-203 CWE-203

Affected Products

Vendor	Product	Versions
google	android	All

References

Advisories & Patches

https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01

Frequently Asked Questions

What is CVE-2026-56888? +

In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. It has a CVSS v3.1 base score of 6.2 (MEDIUM).

How severe is CVE-2026-56888? +

CVE-2026-56888 has a CVSS v3.1 score of 6.2 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0010, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-56888? +

CVE-2026-56888 affects products from google, specifically: android. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-56888? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-114199

`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of …

CVE-2026-53933

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a …

CVE-2026-86532

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated …

CVE-2026-55555

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle …

CVE-2026-78617

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to …

CVE-2026-58503

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password …

CVE-2026-56888