CVE-2026-28658

CVE-2026-28658 is a logic error in the findMetaAuthUid function of AccountsDb.java in the Android operating system that can be abused to defeat Factory Reset Protection (FRP), the mechanism that requires the device owner's Google account after a factory reset. A local attacker with basic code execution on a device needs no additional privileges and no user interaction to trigger the flawed account-lookup path, bypassing the FRP lock and gaining unauthorized access to the device, which Google characterizes as a local escalation of privilege. The practical impact is greatest in scenarios where an attacker has physical or local access, such as after a factory reset of a lost or stolen device. Any Android device shipping the vulnerable framework code is affected, but the bulletin data does not specify an Android version range. No public proof-of-concept exists, the issue is not in CISA's KEV catalog, and its EPSS of 0.1% (3rd percentile) indicates a very low near-term exploitation probability.

What to do: Apply the Android security bulletin update that addresses CVE-2026-28658 via over-the-air updates as soon as your device or MDM fleet receives it, and verify the updated security patch level in Settings > About phone. Because exploitation requires local access (typically after a factory reset), remote exposure is low, but fleet administrators should prioritize the OTA rollout on devices holding sensitive data and users should not leave reset devices unattended until patched.