CVE-2026-28604

CVE-2026-28604 is a use-after-free vulnerability in Android, present 'in multiple locations,' where a race condition allows memory to be freed while still in use. Because it is reachable with no additional execution privileges and requires no user interaction, a remote attacker can trigger the race and gain remote code execution on the affected device. The flaw was addressed in the September 2026 Android Security Update, which Google describes as fixing critical RCE-enabling bugs. Any Android device running a still-affected version that has not yet received that update is potentially exposed, though the bulletin data does not identify the specific component or version range. There is no evidence of exploitation so far: no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at just 0.2%.

What to do: Apply the September 2026 Android security update via OTA as soon as it is offered for your devices, and verify the installed security patch level through device settings or an MDM inventory. Because exploitation requires no user interaction or privileges, prioritize fleet-wide patch verification rather than waiting on user reports. Watch the Android Security Bulletin for follow-up detail on the affected component and version ranges as scoring and technical details are finalized.