What is the CVSS score of CVE-2026-28586?

CVE-2026-28586 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Google Android CVE-2026-28586

EUVD-2026-33815 LOW

Improper Privilege Management (CWE-269)

2026-06-01 google_android

GHSA-cj6w-fvqv-86xp

Privilege Escalation Information Disclosure

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 00:35 vuln.today

CVSS changed

Jun 01, 2026 - 23:22 NVD

3.3 (LOW)

CVE Published

Jun 01, 2026 - 21:14 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Android's AppOpsService (AppOpsService.java) exposes protected system or user information to low-privileged local applications due to missing permission checks across multiple functions, enabling unauthorized information disclosure without requiring additional execution privileges. Affected versions span Android 14 through Android 16-QPR2, representing a broad swath of active Android deployments in use today. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); SSVC rates exploitation as none with only partial technical impact, placing this at low urgency for most organizations.

Technical ContextAI

AppOpsService.java is a core Android framework component responsible for enforcing the App Operations (AppOps) permission system - the runtime layer that governs whether applications may access sensitive capabilities such as location, microphone, camera, and usage statistics. CWE-269 (Improper Privilege Management) identifies the root cause: multiple functions within this service fail to enforce the expected permission checks, allowing callers with only low-level privileges to invoke them and receive protected information they should be denied. The affected CPE (cpe:2.3:a:google:android:*:*:*:*:*:*:*:*) confirms broad platform-level impact. Per ENISA EUVD-2026-33815, the affected branches are Android 14, Android 15, Android 16, and Android 16-QPR2, indicating the flaw was introduced or carried forward across multiple major release lines.

RemediationAI

Apply patches distributed through the Android Security Bulletin dated June 1, 2026, available at https://source.android.com/docs/security/bulletin/2026/2026-06-01. Device manufacturers (OEMs) are responsible for distributing these patches via over-the-air updates; users and administrators should ensure managed devices are updated to the June 2026 Android security patch level or later. No exact patched build version string beyond the security patch level date is independently confirmed from available input data - verify the specific SPL string with your OEM. As a compensating control, enforcing mobile device management (MDM) policies that restrict sideloading and limit installation to trusted application sources (Google Play with Play Protect enabled) directly reduces the attack surface, since exploitation requires a locally installed low-privileged application. This mitigation carries the trade-off of restricting enterprise app distribution workflows that rely on sideloading.