CVE-2026-49883 | Vulnetix

CVE-2026-49883 PUBLISHED CVSS 10 CRITICAL

Reported by google_android · Published September 8, 2026

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Risk Scores

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected Products

Vendor	Product	Versions
Google	Android Wear	14, 16, 17
Google	Android Wear	14, 16, 17

Timeline

Sep 8, 2026 CVE Published
Sep 9, 2026 EPSS Score
Sep 9, 2026 Coalition ESS Score
Sep 10, 2026 EPSS Score
Sep 10, 2026 CVE Updated
Sep 15, 2026 EPSS Score

References

vendor-advisory

Open in Interactive Console →