CVE-2026-28602

A logic error in setClipboardAccessNotificationsEnabledForUser in Android's ClipboardService breaks multi-user isolation of the clipboard, classified as improper access control (CWE-284). The flawed code path can be triggered by a local attacker on an affected Android device without any additional execution privileges and without user interaction. By exploiting it, the attacker can escalate privileges locally, with CVSS rating the impact as high for confidentiality, integrity, and availability (7.8, AV:L/PR:L/UI:N). Affected users are those running impacted Android builds, and exposure is most consequential on devices that use multiple users, work profiles, or app cloning, where clipboard isolation between users matters. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days, so no exploitation is currently known.

What to do: Install the Android security update that includes the fix for CVE-2026-28602 as soon as it reaches your device via Settings > System > System update, and verify the new security patch level afterward. Enterprises should prioritize managed devices using work profiles, secondary users, or app cloning, where multi-user clipboard isolation is most relevant. Until patched, limiting untrusted local apps on multi-user devices reduces interim risk.