CVE-2026-28593

CVE-2026-28593 is a user-interaction bypass in the getItemList function of the Android Settings app component (SettingsFragment.java), classified as a misleading or insufficient UI flaw (CWE-356). It is triggered locally: an application already running on the device with low privileges can abuse the Settings UI state so that the user-interaction requirement is bypassed, and no user interaction is required for exploitation. A successful exploit results in local escalation of privilege with no additional execution privileges needed, with confidentiality, integrity, and availability impacts all rated high in the CVSS calculation. All Android devices that include the Settings app are potentially affected; the available data does not specify which Android version ranges are impacted, and no fixed versions are stated. There is currently no public proof of concept, no CISA KEV listing, and a low EPSS score (0.1% probability of exploitation in 30 days), indicating no known exploitation to date.

What to do: Apply Android security updates from Google or your device OEM as soon as they become available for this CVE, and verify patch status under Settings > About phone > Android security patch level. Until patched, the practical risk is low (EPSS 0.1%, no known PoC or in-the-wild exploitation), but avoid installing untrusted applications since exploitation requires a local app with low privileges. No specific workarounds or fixed version numbers were provided in the source data.