CVE-2026-28590

CVE-2026-28590 is a local privilege escalation flaw in Android caused by a logic error that results in improper validation of encryption keys in multiple places in the code. It is triggered by code already running locally on the device, with no need for special execution privileges and no user interaction, so any app or process with local code execution could potentially exploit it. An attacker who exploits it gains elevated privileges on the affected device, which is most valuable as one link in a chained attack alongside other flaws (the September 2026 Android bulletin also fixed separate remote code execution issues). Affected parties are users of Android devices that have not yet received the September 2026 Android security update; the specific affected version ranges were not detailed in the available data. There is no known public proof of concept, it is not listed in CISA's Known Exploited Vulnerabilities catalog, and its current probability of exploitation within 30 days is estimated at 0.1%.

What to do: Install the September 2026 Android security update as soon as your device or MDM fleet offers it, and verify the installed patch level under Settings > About phone > Android security patch level. Because this flaw is exploitable only with local code execution, prioritize patching devices likely to run untrusted apps, and treat it as high-value to chain with the RCE bugs fixed in the same bulletin. Defenders with managed fleets should confirm OEM rollout schedules, since patch delivery depends on device maker and carrier.