Google Android XR

• CVE-2026-58873 High 8.4 In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execut 0.1%
• CVE-2026-28659 Critical 10.0 In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges ne 0.2%
• CVE-2026-0072 Critical 10.0 In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional executio 0.1%