An unprivileged application can register an activity with the android.car.cluster.NAVIGATION category and request navigation app focus, bypassing the android.car.permission.CAR_DISPLAY_IN_CLUSTER permission. The privileged ClusterHomeSample application, acting as a confused deputy, resolves and launches this arbitrary third‑party activity on the instrument cluster display without enforcing the necessary permission check, allowing a malicious or careless app to persistently present misleading or distracting content on a safety‑critical display.

Google Android systems that include the privileged ClusterHomeSample application are affected. No specific Android OS version is listed, implying that all releases deploying this component could be vulnerable.

The exploit requires local installation of an unprivileged app that registers the NAVIGATION category. The EPSS score is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog, yet the potential for persistent, distracting display content on a vehicle’s instrument cluster represents a high‑impact risk. Attackers can gain a form of privilege escalation to influence vehicle user perception and could disrupt safe driving conditions.