Vulnerability in Google Android

[ Description ]Official description

A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund2 Nov 2026WID-SEC-2026-4288

  Android Patchday November 2026 (Google Android, Automotive OS and XR): Multiple vulnerabilities Translated from German

  Risk highCVE-2026-45201CVE-2026-20561CVE-2026-58956+222 more CVEs

[ References ]References

• source.android.com/docs/security/bulletin/aaos/2026/2026-11-01