CVE-2026-28634

CVE-2026-28634 is a logic error in the permission handling of handleUssdRequest in PhoneInterfaceManager.java, part of the Android telephony (phone) service, which allows a USSD request to be sent without the required permission (CWE-693, protection mechanism failure). A malicious app already present on the device can trigger the flaw locally, with no additional execution privileges and no user interaction, by invoking the USSD request code path. Successful exploitation yields local escalation of privilege in the telephony process context, with high ratings for confidentiality, integrity, and availability (CVSS 3.1: 7.8). All Android devices running the stock AOSP telephony stack that have not yet received the corrective Android security patch are potentially affected. There is currently no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts the 30-day exploitation probability at just 0.1% (2nd percentile).

What to do: Apply the latest Android security patch level as soon as it is available for your device and verify it under Settings > About phone > Android security patch level. Because exploitation requires only a locally installed app with no special permissions, restrict app installs to trusted sources (e.g., managed Play Store listings) until devices are patched. Enterprises should use MDM tooling to audit fleet-wide Android security patch levels and prioritize updates for exposed or high-risk users.