Confused Deputy Vulnerability in MediaTek MiracastService (CVE-2026-20516)

CVE-2026-20516 describes a confused deputy vulnerability found in the MiracastService component (com.mediatek.androidbox) within certain Android TV implementations. The service is incorrectly exported without access controls and possesses android.uid.system privileges. A local attacker can supply a malicious intent extra, screen_share, to the MiracastService via onStartCommand(). This forces the service to perform privileged actions, specifically the management of Wi-Fi Direct groups using WifiP2pManager.createGroup(), despite the caller lacking the necessary permissions. MediaTek acknowledged the flaw in its September 2026 security bulletin (MSV-7882). The vulnerability poses a risk of local denial of service and unauthorized state manipulation on impacted Android TV firmware.

Attack Chain

1. Attacker gains local code execution on an Android TV device.
2. Attacker identifies the com.mediatek.androidbox package and the MiracastService component.
3. Attacker constructs an Android intent targeting MiracastService.
4. Attacker attaches the intent extra --ez screen_share false to the intent.
5. Attacker executes am startservice to invoke the exported, unprotected service.
6. The service, running as android.uid.system, receives the intent and fails to validate the caller's authorization.
7. The service executes the createGroup() method via WifiP2pManager, bypassing intended system constraints.
8. Final objective: Successful manipulation of Wi-Fi Direct state, leading to denial of service of Miracast functionality.

Impact

The vulnerability allows local attackers to disrupt legitimate Miracast service usage and manipulate system-level Wi-Fi Direct states. While the PoC demonstrates state manipulation and denial of service, it does not confirm arbitrary code execution or privilege escalation to root. The flaw affects Android TV devices using MediaTek chipsets, though the specific impact depends on OEM-provided firmware updates.

Recommendation

Prioritize patching based on the following:

• Verify firmware versions against the MediaTek patch identifiers ALPS11060069 or DTV04881615.
• Disable android:exported for components handling sensitive lifecycle operations in custom Android applications.
• Enforce signature-level permissions for any component that must be externally accessible.
• Ensure all service entry points perform explicit caller authorization checks.