Android XR vulnerabilities

3 known vulnerabilities in Android XR from Google. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.4 High severity

  Android XR: Missing Authorization

  CVE-2026-58873Nov 2, 2026Google

  In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex

• 7.8 High severity

  Android XR: Improper Privilege Management

  CVE-2026-28659Sep 8, 2026Google

  In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• 7.8 High severity

  Android XR: Improper Authorization

  CVE-2026-0072Jun 1, 2026Google

  In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for expl