Which versions of Android Telecomm are affected by CVE-2026-28615?

Google Android's Telecomm component in Android 17 contains a critical privilege escalation (CVE-2026-28615, CVSS 10.0) allowing locally installed applications to bypass permission checks and initiate…

How to fix or mitigate CVE-2026-28615?

Within 24 hours: Conduct comprehensive audit of Android 17 device inventory using MDM tools and assess organizational exposure. Within 7 days: Deploy app whitelisting policies via MDM, explicitly restrict CALL_PHONE permissions for third-party applications, and implement outbound call pattern monitoring. Within 30 days: Establish patch tracking with Google and device OEMs; develop and schedule rollout plan for Android 17 security updates when vendor releases patched build.

Android Telecomm CVE-2026-28615

Q: What is the CVSS score of CVE-2026-28615?

CVE-2026-28615 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37572 CRITICAL

Missing Authorization (CWE-862)

2026-06-17 google_android

Authentication Bypass Privilege Escalation Google

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Local because a malicious app must be installed (AV:L); low app privileges suffice (PR:L); no user interaction; impact limited to unauthorized call initiation, not full device compromise.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:20 vuln.today

CVE Published

Jun 17, 2026 - 07:17 cve.org

CRITICAL 10.0

DescriptionCVE.org

In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android's Telecomm component allows applications to initiate unauthorized phone calls by bypassing permission checks, with no user interaction required. The flaw is reported through the Android Security Bulletin for Android 17 and carries a CVSS 4.0 score of 10.0, though no public exploit identified at time of analysis. Despite the network-vector CVSS rating, the description characterizes this as local escalation of privilege, suggesting realistic exploitation requires a malicious app already installed on the device.

Technical ContextAI

The Android Telecomm framework (android.telecom) is the system service that manages call routing, phone accounts, and ConnectionServices for both cellular and VoIP calls. Initiating outbound calls normally requires the CALL_PHONE runtime permission (or CALL_PRIVILEGED for emergency/system calls), enforced by Telecomm before placing a call via TelecomManager.placeCall() or related APIs. A permissions bypass in this code path means the Telecomm service fails to properly validate the calling UID/package against its declared permissions, allowing a caller that lacks CALL_PHONE to reach the call placement logic. No CWE was assigned in the input, but the behavior is consistent with CWE-862 (Missing Authorization) or CWE-280 (Improper Handling of Insufficient Permissions). The affected CPE google:android:* does not narrow to specific Android versions in the supplied data, but the linked bulletin (Android 17) implies the fix is delivered in that release line.

RemediationAI

Apply patch available per vendor advisory by installing the Android security patch level corresponding to the Android 17 bulletin at https://source.android.com/docs/security/bulletin/android-17 - on Pixel devices this arrives via OTA, and on OEM devices it will follow each vendor's rollout schedule. Until the patch is deployed, compensating controls are limited because the bypass sits inside system Telecomm code: restrict app installation to Google Play (disable 'install unknown apps') to reduce the population of attacker-controlled apps that could exercise the bypass, use MDM to enforce app allowlisting on managed fleets, and on enterprise devices consider provisioning a work profile that blocks the dialer/telephony stack for untrusted apps. Monitoring call detail records or carrier billing for unexpected outbound calls is a useful detection compensating control with the trade-off of being post-facto only.