Android Telecomm CVE-2026-28615

Requires a malicious application already installed and running on the target Android device - the description characterizes this as 'local escalation of privilege,' so a network-only attacker cannot trigger it without first landing code on the device. The bypass eliminates the need for the CALL_PHONE runtime permission that legitimate dialers must request, and no user interaction is required at exploit time (UI:N). Limiting factors: the attacker must achieve initial app execution (Play Protect, app review, and sideload restrictions all raise the bar), and exploitation is constrained to actions reachable through the Telecomm call-initiation API surface - it does not by itself yield arbitrary code execution as system_server or root.

The signals are conflicting and warrant skepticism of the headline 10.0 score. The CVSS 4.0 vector states AV:N/PR:N/UI:N with H impact across confidentiality, integrity, availability, and subsequent-system metrics, which would imply unauthenticated remote takeover - but the description explicitly says 'local escalation of privilege,' meaning the attacker must already have code execution on the device (typically via an installed app). The realistic attack vector is therefore AV:L, not AV:N, and the true impact is unauthorized call initiation (toll fraud, premium-rate abuse, or covertly enabling microphone audio paths) rather than full device compromise - so the SC:H/SI:H/SA:H subsequent-system ratings appear inflated. No EPSS score, no KEV listing, and no public exploit identified at time of analysis; the only source is the Android Security Bulletin. Net assessment: a genuine permission-model bug worth patching in the monthly cycle, but not a drop-everything network RCE despite the 10.0 number.

A malicious app published to a third-party store, or sideloaded via social engineering, declares no telephony permissions (avoiding install-time scrutiny) and at runtime calls into the Telecomm API surface to place outbound calls to premium-rate or attacker-controlled numbers without prompting the user. With UI:N this can occur silently in the background, enabling toll fraud, exfiltration via DTMF, or use as a stepping stone to escalate within the telephony stack.