Android CVE-2026-28590

The attacker must have local code execution on the target device at low privilege (PR:L), meaning a malicious app or shell-level user session is required. No user interaction is needed once local execution is established. The flaw exists across multiple code locations, suggesting exploitation may be achievable through more than one code path, though each requires the local execution prerequisite. What limits exploitation: the attack vector is strictly local (no remote path), the attacker must already have a foothold on the device, and SSVC assesses the attack as non-automatable, meaning no self-propagating or drive-by exploitation is feasible. There is no indication that a specific non-default configuration or feature flag must be enabled - the flaw appears present in default builds of the affected Android versions.

The CVSS 7.8 score accurately reflects the local attack vector (AV:L) and high CIA impact; however, real-world exploitation risk is tempered by multiple converging signals. SSVC designates exploitation as 'none' and automatable as 'no,' meaning no weaponized code is circulating and mass exploitation is not feasible. EPSS at 0.11% (2nd percentile) places this firmly in the low-probability tier for near-term exploitation. Despite the 'Technical Impact: total' SSVC rating - which acknowledges worst-case device compromise - the requirement for existing local code execution (PR:L) limits the attacker pool to apps already installed on the device or users with shell access. This is not a remote vector; even a mid-sized municipal IT team in swidnica should treat this as a firmware update priority but not an emergency incident-response trigger, provided device enrollment policies restrict sideloading. The breadth of affected versions (Android 14 through 16-qpr2) across a ubiquitous platform is the primary concern, as the cumulative installed base is enormous even if individual exploitation probability is low.

An attacker with a low-privileged application already running on a victim Android device crafts key material that exploits the logic error in the encryption key validation routine - potentially via algorithm confusion or a malformed JWT structure - causing the system to accept an invalid key as legitimate. This bypasses the cryptographic gate protecting an elevated privilege boundary, granting the attacker full system-level access. No public exploit code exists at time of analysis, so exploitation requires independent vulnerability research by a capable threat actor.