CVE-2026-49881

总结

在InCallController.java的serviceClassExists方法中，由于代码中的逻辑错误，存在可能执行任意代码的情况。这可能导致本地权限提升，且无需额外的执行权限。利用该漏洞无需用户交互。

• TLPEPoC

  CVE-2026-49881, using insecure context creation in Android 17's Telecom service to execute arbitrary code as UID 1000 system_server from an unprivileged app

• LSPromise漏洞利用

  Android complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel, combination of CVE-2026-49881 and CVE-2026-43284