Android CVE-2026-28624

Exploitation requires that the attacker already has a low-privileged process executing on the target Android device - equivalent to a normally installed application granted standard permissions (PR:L per CVSS). The attacker must be able to invoke the specific vulnerable system service(s) that improperly proxy file operations; these service identities are not enumerated in the available advisory. No network access is required during the exploit itself and no user interaction is needed once the malicious process is running. Limiting factors: the attacker must first achieve application installation or execution via a separate vector (social engineering, a prior vulnerability, or physical device access); SSVC Automatable: no confirms the exploit cannot be delivered at scale over the network; and the specific file paths or service interfaces involved are not disclosed, requiring reverse engineering of the patch to identify precise trigger conditions.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N accurately reflects the exploitation prerequisites: the attacker must already have code executing on the device at low-privilege application level, limiting the realistic attack surface to post-installation scenarios. EPSS of 0.11% (2nd percentile) and SSVC Exploitation: none indicate no active exploitation observed at time of analysis, and SSVC Automatable: no confirms that mass network-level exploitation is not feasible given the local-access requirement. Despite SSVC Technical Impact: total and full C:H/I:H/A:H CVSS impact, the real-world urgency is moderate for most environments because an attacker must first obtain app execution on the target device. The 'multiple locations' framing suggests bundled fixes for a broad architectural pattern, which may complicate complete remediation if OEM vendors carry delayed patch integration. No conflicting signals between available data sources - all indicators consistently point to a locally-exploited, non-automated, high-impact but not imminently weaponized vulnerability.

A malicious application already installed on an affected Android 16 or 17 device calls into a vulnerable privileged system service, crafting requests that cause the service to access restricted file paths using its own elevated credentials rather than the application's. The confused deputy writes attacker-controlled data to a protected system file or reads sensitive credential material outside the application's declared permissions, granting the attacker effective privilege escalation. No public exploit code exists at time of analysis, but the local-access requirement and absence of user interaction make this viable for targeted attacks following initial device compromise.