Android CVE-2026-28625

Exploitation requires an attacker to already hold low-level privileges on the device - i.e., the ability to run local code such as a pre-installed malicious or compromised app or a local shell (CVSS PR:L, AV:L). From that position, the flaw is triggered automatically by invoking the vulnerable permission-check logic, needing no user interaction (UI:N) and no additional execution privileges. Limiting factors: no remote network vector exists, the attacker must first achieve local low-privilege execution, and the device must run an affected version (Android 14, 15, 16, 16-qpr2, or 17); note the specific vulnerable component is described only as 'multiple locations,' and the sole reference is the Android Automotive OS bulletin, so general-handset applicability should be confirmed with the vendor.

Signals are largely consistent and point to a genuine but not emergency-grade issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity privilege escalation requiring pre-existing low-level privileges (e.g., an already-installed app or local shell), with total impact (C:H/I:H/A:H) - matching CWE-269 (Improper Privilege Management) and the SSVC 'Technical Impact: total' rating. However, the exploitation-likelihood signals are low across the board: SSVC reports Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public exploit code is referenced. EPSS was not supplied in the input. In short, this is a high-severity-by-impact flaw with currently low real-world exploitation pressure - a solid patch-cycle priority rather than a drop-everything emergency, consistent with how most monthly Android Security Bulletin local EoP bugs behave. One caveat to verify: the sole substantive reference is the Android Automotive OS (AAOS) bulletin, while the CPE is the generic google:android - confirm with the vendor whether this affects general Android handsets, AAOS, or both, as that materially changes the exposed population.

A malicious or compromised low-privilege app already present on an affected Android 14-17 device abuses a logic error in permission checking to bypass intended privilege boundaries and escalate to higher privileges without any user interaction. No public exploit code is identified at time of analysis, and exploitation requires prior local code execution at low privilege.