CVE-2026-58930

An unprivileged application can exploit a lack of package/signature validation in SystemUI's RemoteQCController when resolving a hardcoded content:// URI. If the legitimate package is absent, an attacker can squat on a specific authority to inject spoofed UI elements into the trusted SystemUI Qui...