EUVD-2026-115552
GHSA-x828-m68h-r2jw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run malicious local app
-
DeliveryInvoke writeGrantedUriPermissions with crafted input
-
ExploitBypass URI permission validation
-
ExecutionGain unauthorized permissions
-
ImpactLocal privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires local code execution on the device - the attacker must already be running code (such as a malicious or compromised installed app) that can reach the writeGrantedUriPermissions path in UriGrantsManagerService; the flaw is improper input validation on the URI-permission-grant input, which bypasses permission checks. Per the CVSS vector no app permissions (PR:N) and no user interaction (UI:N) are needed. The key LIMITING factor is the AV:L local attack vector: this cannot be triggered remotely and only applies to Android 14, 15, 16, and 16-qpr2 as listed in the EUVD record. |
| Impact | This is a locally-exploitable Android privilege-escalation flaw with a high CVSS of 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning high confidentiality, integrity and availability impact once an attacker already has code execution on the device. The signals do NOT all point to urgent, widespread danger: SSVC reports Exploitation: none and Automatable: no (with Technical Impact: total), there is no CISA KEV listing, no POC is referenced, and no EPSS score was provided. The vuln.today decision label is 'this_week', a moderate rather than emergency priority, consistent with a serious-but-not-actively-exploited local bug. The apparent tension between CVSS 'PR:N' and the description's 'local escalation of privilege' is resolved by the AV:L vector: no app permissions are required (PR:N), but the attacker must already be able to run code locally (e.g. a malicious app), so this is a privilege-escalation primitive rather than a remote compromise. Treat it as a real patch-this-cycle priority for the affected Android versions, but not a drop-everything emergency on current evidence; EPSS is missing, so exploitation probability could not be weighed. |
| Exploit ScenarioDerived | A malicious or compromised app already installed on an Android device invokes the affected URI-permission-granting path (writeGrantedUriPermissions in UriGrantsManagerService) with crafted input that the service fails to validate, bypassing permission checks. No user interaction and no additional execution privileges are needed, so the app silently gains access it should not have, escalating to higher privileges. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Local privilege escalation in Android's UriGrantsManagerService (Android 14, 15, 16 and 16-qpr2) lets code already running on the device bypass URI permission checks through improper input validation in writeGrantedUriPermissions. Per the CVSS vector (AV:L/AC:L/PR:N/UI:N) a local attacker needs no additional app permissions and no user interaction, yielding high confidentiality, integrity and availability impact. No public exploit is identified at time of analysis and CISA SSVC records no observed exploitation, though an Android Security Bulletin reference is provided for the fix.
RemediationAI
Apply the Android Security Bulletin 2026-11-01 update (https://source.android.com/docs/security/bulletin/2026/2026-11-01), which is the vendor-released fix for this issue; no exact build or patch-level string is given in the supplied data, so administrators should apply the bulletin's patch level or later for their device branch (Android 14, 15, 16, 16-qpr2) and verify the security patch level in Settings after updating. Because exploitation requires local code execution (AV:L) and the attacker must already be running code able to reach the writeGrantedUriPermissions path, the practical compensating controls until patched are to reduce the installable attack surface - restrict sideloading and unknown sources, enforce Google Play Protect scanning, and limit which apps can be installed on managed devices via policy - accepting that this only removes delivery vectors and does not fix the permission-bypass itself. Until a device receives the bulletin update, treat any locally running app as potentially able to escalate to system-level URI access.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UriGrantsManagerService is the Android system service that brokers URI permission grants, allowing one app to hand another temporary access to a content provider URI (for example through Intent.FLAG_GRANT_READ_URI_PERMISSION or FLAG_GRANT_WRITE_URI_PERMISSION). The flaw is classified as CWE-20 improper input validation: writeGrantedUriPermissions does not adequately validate the URI-permission-grant input it processes, so a caller can construct input that causes a grant to be recorded or propagated inconsistently with the intended permission checks, bypassing them. Because this is a system service reachable from a locally installed app, the attack vector is local (AV:L) with no privileges required (PR:N) and no user interaction (UI:N); successful exploitation grants high confidentiality, integrity and availability impact on the device. Google's bulletin attributes the issue to the Android platform broadly, with EUVD listing Android 14, 15, 16 and 16-qpr2 as affected. The trigger path details beyond the vulnerable method are not described in the available sources.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:L because the attacker needs local code execution; PR:N/UI:N because the description states no additional execution privileges and no user interaction; C/I/A:H for a total-impact privilege escalation.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
Executive ViewAI
CVE-2026-28597 is a high-severity local privilege escalation flaw in Android's UriGrantsManagerService affecting versions 14, 15, 16, and 16-qpr2. A malicious app on a user's device could exploit this to bypass URI permission checks, gaining unauthorized access to sensitive data and system functions without user interaction. This puts enterprise data at risk, especially in BYOD or mobile workforce scenarios where compromised apps could undermine the integrity and confidentiality of corporate resources.
No vendor-released patch identified at time of analysis. Interim mitigations include strict app vetting, disabling installation from unknown sources, deploying mobile threat defense, and enforcing least privilege on devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB