CVE-2026-56960 – Google Android
“An attacker in radio range does not need a click or a password to take over a phone, so every unpatched Android device is an open door into the business.”
This Android update fixes seven remote flaws in Bluetooth, the IP Multimedia Subsystem, the cellular modem, and core memory handling. None of them needs any user action to exploit. Attackers are actively exploiting CVE-2026-58704, a permission bypass in the cellular modem that lets a nearby attacker gain elevated privileges. CVE-2026-58704 has a CVSS score of 8.8, High severity.
Six more flaws are rated Critical, each with a CVSS score of 9.8. CVE-2026-49921 and CVE-2026-58822 are memory safety flaws that allow remote code execution. CVE-2026-55330 is a Bluetooth use-after-free that also allows remote code execution. CVE-2026-28606 lets an attacker skip Bluetooth pairing and gain privileges without user consent. CVE-2026-55366 bypasses authentication in the IP Multimedia Subsystem, and CVE-2026-56960 is a use-after-free in several components; both allow remote privilege escalation. Treat this update as an immediate priority for every managed Android device.
Key Details
- Affected Product
- Google Android
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-416