Android CVE-2026-28620

The attacker must have low-privilege code execution on the target device (PR:L), consistent with a malicious application already installed and running in a restricted sandbox. No user interaction is required after the malicious code is running (UI:N). The attack vector is strictly local (AV:L), ruling out remote-only network exploitation. No non-default configuration appears to be required - the flaw exists in standard Android URI permission enforcement logic present across Android 16, 16-QPR2, and 17. The specific vulnerable URI endpoints or code locations are not disclosed in the advisory. Exploitation is not automatable per SSVC (Automatable: no), suggesting some targeted setup or installation step is required.

The CVSS 7.8 base score reflects a local, low-complexity attack requiring only low privileges and no user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). EPSS at 0.12% (2nd percentile) and SSVC Exploitation: none both indicate no current active exploitation or widespread weaponization, and the vulnerability is not listed in CISA KEV. However, SSVC Technical Impact: total underscores that successful exploitation results in complete device compromise - even a mid-sized municipal IT team in ustka managing a corporate Android fleet should treat this as an urgent patch priority given the low exploit complexity (AC:L) once an attacker has minimal device access. The 'Authentication Bypass' tag applied to this CVE is a mislabel; CWE-863 is Incorrect Authorization, an authorization-layer flaw distinct from authentication bypass. The CVSS vector is internally consistent with the description and no conflicts with referenced advisory data are observed.

An attacker installs a malicious low-privilege application on the target Android device, either directly or through a third-party app store. The app crafts requests to URIs whose permission checks are incorrectly enforced, exploiting one or more of the vulnerable code locations to bypass the authorization gate. The app then escalates from its sandbox to elevated privileges, gaining full read/write/execute access to the device without requiring any user interaction. No public exploit code has been identified at time of analysis.