Android CVE-2026-28602

Exploitation requires a malicious application with code execution capability running under a low-privileged Android user account (PR:L) on a device with Android 14, 15, 16, 16-qpr2, or 17. The practical prerequisite is that at least two user profiles exist on the device (the attacker's and a victim's), which is the multi-user configuration scenario most exposed. Physical or social-engineering access to install the malicious app under the attacker's user account is the realistic initial barrier. No network access, no elevated privileges, no special permissions beyond normal app execution, and no victim interaction are required once the app is installed. Single-user Android deployments are less exposed since there are no alternate user profiles to target, though the vulnerable code path is still present. Exploitation is bounded by the CVSS S:U scope - impact is limited to the device's user-space data and does not extend to the underlying OS kernel or hardware.

CVSS 7.8 with a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), and no user interaction (UI:N) accurately characterizes this as a local privilege escalation requiring only an installed app running under an unprivileged user account. The full C:H/I:H/A:H impact reflects the potential to read, modify, or disrupt data across user boundaries once the isolation is bypassed. EPSS at 0.12% (2nd percentile) is very low, there is no CISA KEV listing, and no public proof-of-concept has been identified, all of which indicate no observed in-the-wild exploitation. Under the SSVC framework, exploitation would likely be rated 'none' and technical impact 'partial' given the local access prerequisite. Real-world exposure is concentrated on multi-user Android deployments - enterprise MDM-managed tablets, shared-device kiosk environments, and family-sharing configurations - where multiple distinct user profiles coexist on one device. Single-user consumer devices face reduced practical risk even though the vulnerable code path is present. The breadth of affected versions (Android 14-17) means the patch surface is large and OEM update cadence variability extends exposure windows for some device populations.

An attacker installs a malicious application under their own low-privileged Android user account on a shared device (such as a family tablet or enterprise kiosk) running Android 14-17. The malicious app calls the vulnerable setClipboardAccessNotificationsEnabledForUser path with a crafted target user identifier, bypassing the multi-user isolation check to read or modify clipboard data belonging to another user profile - potentially capturing passwords, authentication tokens, or sensitive text copied by the victim user. No user interaction from the victim is required once the malicious app is running.