The vulnerability identified as CVE-2026-58726 exists in the FsmReleaseKey function within the fsm.c component of Google Android. A missing permission check allows a local attacker who already has system execution privileges to bypass intended permission restrictions, resulting in an elevation of privilege. Exploitation does not require user interaction. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with system execution privileges on the affected Android device can exploit this vulnerability to bypass permission checks and escalate privileges further. This could lead to unauthorized access or control over sensitive system functions or data. Since user interaction is not required, exploitation could be automated or triggered without user consent. However, the attacker must already have system-level execution privileges, limiting the initial attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restricting access to system execution privileges and monitoring for suspicious local activity may help reduce risk.