The vulnerability CVE-2026-49895 in Google Android is caused by an incorrect bounds check in the get_eht_operation_channel_width function of ieee802_11_common.c, leading to a possible out-of-bounds read. This flaw can be exploited remotely by an attacker in close proximity to disclose information without needing user interaction or elevated privileges. The affected versions explicitly include Android 14, 15, 16, 16-qpr2, and 17. No CVSS score or vendor remediation information is currently available.

This vulnerability allows a remote attacker near the target device to disclose information from memory due to an out-of-bounds read. No additional execution privileges or user interaction are required, which increases the risk of information leakage. However, no known exploits in the wild have been reported, and the exact impact depends on the nature of the disclosed information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor communications for updates. No specific mitigations are provided in the current data.