CVE-2026-28616

CVE-2026-28616 is a confused-deputy vulnerability (CWE-441) in the Setup Wizard component of Android, assigned by Google's Android security team ([email protected]). An attacker who already holds low-privilege access on the device can trigger the Setup Wizard into forcing a connection to an attacker-controlled network without any user interaction, and this can be leveraged into a local escalation of privilege. Successful exploitation carries high impact — confidential data disclosure, integrity compromise, and denial of service — without requiring any additional execution privileges beyond the initial local foothold. All Android devices shipping an affected Setup Wizard build are potentially exposed; the available data does not enumerate specific affected Android versions, so defenders should consult the Android Security Bulletin patch details for their device. No public proof of concept is known, the issue is absent from CISA's Known Exploited Vulnerabilities catalog, and EPSS currently rates the 30-day exploitation probability at roughly 0.1% (2nd percentile), so no in-the-wild exploitation is known at this time.

What to do: Patch via the Android monthly security update / OEM firmware that includes the fix for CVE-2026-28616, and verify the installed patch level in Settings > About phone > Android security update. No interim network mitigations are meaningful because the attack is local, but prioritizing updates on shared or multi-user devices reduces risk since the attacker needs low-privilege local access. No public exploit or in-the-wild abuse is known at this time.