CVE-2026-58834: Android Frameworks Base Package Denial of Service Vulnerability
Summary
CVE-2026-58834: In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. Affects platform/frameworks/base across 6 version ranges.
>= 14:0, < 14:2026-10-01
>= 15:0, < 15:2026-10-01
>= 16:0, < 16:2026-10-01
>= 16-qpr2:0, < 16-qpr2:2026-10-01
>= 17:0, < 17:2026-10-01
>= 17-next:0, < 17-next:2026-10-01
Fixed in 17-next:2026-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development and device management. It includes functionalities related to device policy management, security, and user permissions. This package is crucial for maintaining the integrity and performance of Android devices, making its security paramount.
Vulnerability Detail
The vulnerability identified as CVE-2026-58834 exists in the setPermissionGrantState method of DevicePolicyManagerService.java. It arises from improper input validation, which can lead to a persistent denial of service (DoS) condition. This vulnerability allows an attacker to exploit the system without requiring additional execution privileges or user interaction, potentially causing significant disruption to device functionality.
How To Fix
Minimum fixed version
17-next:2026-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the permissions granted to applications until the patch is applied. This can be done by reviewing and adjusting the permission settings in the device's security settings. Additionally, monitoring tools like Vulert can be utilized to track vulnerabilities in real-time without requiring code access or installation.
Conclusion
CVE-2026-58834 represents a critical vulnerability in the Android Frameworks Base package that can lead to a denial of service. It is essential for developers and users to apply the necessary patches and monitor their applications for vulnerabilities using tools like Vulert to ensure ongoing security.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2026-58834 is a vulnerability in the Android Frameworks Base package that can lead to a persistent denial of service due to improper input validation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can result in a denial of service, disrupting the normal functionality of the device without requiring user interaction.
Update the Android Frameworks Base package to the patched version by modifying your build.gradle file to include the fixed version as specified in the 'how_to_fix' section.
No, user interaction is not needed for exploitation, making it a significant security concern.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
