SECURITYHIGHCVE-2026-49906

CVE-2026-49906: Android Automotive Cluster Permission Bypass via Confused Deputy

An unprivileged app can bypass CAR_DISPLAY_IN_CLUSTER in Android Automotive OS by abusing ClusterHomeSample. Apply the November 2026 AAOS bulletin patch.

Dylan H.

Security Team

November 3, 2026
3 min read
CVE-2026-49906: Android Automotive Cluster Permission Bypass via Confused Deputy

Affected Products

  • Android Automotive OS 14
  • Android Automotive OS 15
  • Android Automotive OS 16 and 16-qpr2
  • Android Automotive OS 17

CVE-2026-49906: Instrument Cluster Permission Bypass in Android Automotive OS

CVE-2026-49906 is a permission-bypass flaw in Android Automotive OS (AAOS), published to NVD on 2026-11-02 and covered by the AAOS security bulletin dated 2026-11-01. An unprivileged application can bypass the android.car.permission.CAR_DISPLAY_IN_CLUSTER permission and place content on the vehicle instrument cluster.

NVD analysis is still pending, so severity differs between sources. The record carries a CVSS score of 7.8 in the feed we track, while some aggregators rate it lower. We classify it as high pending NVD scoring.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-49906
CVSS Score7.8 (per feed; NVD analysis pending)
ClassImproper access control / confused deputy
ComponentClusterHomeSample (privileged system app)
AffectedAndroid 14, 15, 16, 16-qpr2, 17 (Automotive)
Attack VectorLocal
ExploitationNo public exploit; not in CISA KEV; no reported exploitation

Technical Analysis

The CAR_DISPLAY_IN_CLUSTER permission controls which apps may render content on the instrument cluster, which matters for driver safety. The bug is a classic confused deputy:

  1. A malicious app registers an activity with the android.car.cluster.NAVIGATION category.
  2. It requests navigation app focus.
  3. The privileged ClusterHomeSample app resolves and launches that activity on the cluster display without checking that the requesting app holds CAR_DISPLAY_IN_CLUSTER.

The privileged component acts on behalf of the unprivileged caller, so the permission check is effectively skipped.

A related cluster CVE, CVE-2026-49903, involves ClusterRenderingService.dump() and is also a confused-deputy issue.

Impact

Impact AreaRisk
Instrument cluster contentAn app without the permission could display content in the driver's cluster
Driver distraction / spoofingMisleading or distracting content in a safety-relevant display
Remote exploitationNot indicated — attack requires a locally installed app

Remediation

  1. Apply the vendor patch from the November 2026 Android Automotive OS bulletin. OEMs and Tier-1 suppliers must integrate and ship the fix in vehicle software updates.
  2. If you maintain a custom cluster implementation derived from ClusterHomeSample, add an explicit CAR_DISPLAY_IN_CLUSTER permission check on the caller before resolving or launching navigation activities.
  3. Restrict sideloading and review installed third-party apps on development and test head units.

Key Takeaways

  1. CVE-2026-49906 lets an unprivileged app reach the instrument cluster through a privileged sample app.
  2. It affects AAOS 14 through 17 and requires local app execution.
  3. No exploitation has been reported. Treat it as a patch-cycle item for OEMs rather than an emergency.
  4. Sample code shipped as a reference implementation is often copied into production. Audit forks for the same missing check.

Sources