CVE-2026-58880: Elevation of privilege in Google Android

This vulnerability involves a race condition in the handle_app_val_response function of the Bluetooth interface component (btif_rc.cc) in Google Android. Exploiting this flaw could enable an attacker to execute code locally and escalate privileges without needing any additional execution rights or user interaction. The affected versions explicitly include Android 16, 16-qpr2, and 17.

Successful exploitation could lead to local privilege escalation on affected Android devices, allowing an attacker to gain higher privileges than originally granted. No user interaction is required, increasing the risk of silent exploitation. However, there is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users and administrators should monitor Google's security advisories for updates and apply patches once available.