What is the CVSS score of CVE-2026-28587?

CVE-2026-28587 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.2%.

Which versions of Android are affected by CVE-2026-28587?

A critical vulnerability in Android's MmsSmsProvider component allows malicious apps installed on a device to access SMS and MMS messages without permission, creating a direct channel for attackers…

How to fix or mitigate CVE-2026-28587?

24 hours: Inventory all Android devices in the organization and identify those running versions prior to Android 17; document which devices process sensitive SMS data (2FA codes, banking alerts, health communications). 7 days: Evaluate Android 17 compatibility with business applications and MDM infrastructure; develop deployment timeline. 30 days: Deploy Android 17 to all vulnerable devices or implement compensating MDM controls for devices unable to update within 30 days.

Android CVE-2026-28587

EUVD-2026-37574 CRITICAL

Missing Authorization (CWE-862)

2026-06-17 google_android

Information Disclosure Google

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today AI

6.2 MEDIUM

Local app-to-provider attack with no permissions and no UI; only SMS/MMS confidentiality is impacted, so C:H with I:N/A:N and AV:L, not AV:N.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:22 vuln.today

CVE Published

Jun 17, 2026 - 07:21 cve.org

CRITICAL 10.0

DescriptionCVE.org

In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local information disclosure in Android's MmsSmsProvider component allows installed applications to read sensitive SMS/MMS data without holding the required permissions. The flaw stems from a missing permission check inside MmsSmsProvider.java, enabling any local app to query the content provider and exfiltrate message data without user interaction. No public exploit identified at time of analysis, and the issue is addressed in the Android Security Bulletin for Android 17.

Technical ContextAI

MmsSmsProvider is the Android ContentProvider that brokers access to combined SMS and MMS message data stored on the device, normally gated by READ_SMS and related signature/dangerous permissions. The vulnerability is a classic missing-authorization flaw (CWE-862-class - though CWE is reported as N/A here) where one or more query paths in MmsSmsProvider.java fail to enforce the permission check before returning data. Affected CPE is cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, indicating the AOSP framework rather than an OEM-specific build, and the fix flows through the standard monthly bulletin.

RemediationAI

Patch available per vendor advisory: apply the Android 17 security patch level documented at https://source.android.com/docs/security/bulletin/android-17 as soon as the OEM distributes it for the affected device. On managed fleets, raise the minimum patch level in MDM compliance policy to the bulletin date that lists CVE-2026-28587 and quarantine devices that cannot update. Until devices are patched, restrict installation of untrusted third-party apps (enforce Play Protect, disable sideloading via MDM) and consider moving SMS-based 2FA to an authenticator app or hardware key, since SMS contents are exactly what this flaw leaks; the trade-off is user friction for sideloading workflows and 2FA re-enrollment effort.