CVE-2026-28624

CVE-2026-28624 is a confused-deputy flaw (CWE-441) in Android that, across multiple code locations, allows read/write access to files without proper permission checks. It is triggered by a local attacker who already has low-privilege code execution on a device; no user interaction and no additional privileges are required for exploitation. A successful exploit yields local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/PR:L/UI:N). Because the CNA is Android's security team, this affects Android-based devices, though specific affected version ranges are not provided in the available data. There is currently no known public proof-of-concept, no entry in CISA KEV, and a low EPSS score of 0.1%, indicating no confirmed in-the-wild exploitation.

What to do: Apply the Android security update that addresses this issue as soon as your OEM releases it, and check the Android Security Bulletin for the patch level covering CVE-2026-28624. Since the flaw requires only local low-privilege access and no user interaction, prioritize patching devices that run untrusted or side-loaded apps and shared/managed fleets, and monitor OEM advisories for device-specific build availability.