CVE-2026-28668

A logic error in the LimitRealloc function of malloc_limit.cpp, a component of the Android platform's native memory-allocator code, can leave a freed allocation in use, creating a use-after-free condition. The flaw is triggered through memory reallocation handling and requires no user interaction to exploit. An attacker who can already execute code locally without special privileges, such as an installed app, could leverage the memory corruption to escalate privileges on the device. Affected users are those on Android devices carrying the vulnerable allocator code; the advisory data does not specify affected or fixed version ranges. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and EPSS currently estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: Install the Android security update addressing CVE-2026-28668 as soon as it is delivered by Google or your device OEM, since no version ranges or user-level mitigations are specified in the available data. Verify the device's current Android security patch level under Settings > About phone and confirm it includes the bulletin fixing this issue. With no known public exploit or in-the-wild activity, treat this as routine patching rather than emergency response.