Android CVE-2026-28634

Exploitation requires a malicious app to be installed on the target Android device - the attacker must hold at minimum standard app-installation-level privileges on the device (CVSS PR:L, AV:L). Once installed, no additional permissions, elevated capabilities, special device configuration, or user interaction are needed to trigger the flaw; the vulnerable handleUssdRequest code path is reachable from a standard low-privilege app context on default Android configurations (CVSS AC:L, UI:N). The primary limiting factor is the local attack vector: the adversary must first achieve app delivery and installation, whether via social engineering, third-party app stores, phishing links, or physical access. No remote unauthenticated exploitation path exists. Exploitation is constrained to Android 14-17 (including 16-QPR2) devices running pre-September-2026 security patch levels.

The CVSS 7.8 High vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a realistic local attack: a malicious app with only baseline installation-level privileges can reach the vulnerable code path with no user interaction and no elevated access. SSVC labels the technical impact 'total', consistent with the C:H/I:H/A:H triad, because unrestricted USSD dispatch can interact with carrier services in ways that affect confidentiality, integrity, and availability of both device and account. EPSS at 0.12% (2nd percentile) signals very low current exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis - SSVC exploitation status is 'none'. The primary real-world constraint is the local attack vector: the adversary must first achieve app installation on the target device, which substantially narrows opportunistic exploitation; even a mid-sized municipal IT team in sopot managing a corporate Android fleet should treat this as a standard monthly-patch-cycle priority rather than requiring emergency out-of-band remediation, unless sideloading controls are absent or the threat model includes targeted spyware delivery.

An attacker publishes a malicious Android app requesting only innocuous-looking permissions (e.g., internet access, storage) and distributes it through third-party channels or phishing. Once installed with minimal privileges on a vulnerable device, the app directly invokes handleUssdRequest, exploiting the logic error to bypass the telephony permission gate and dispatch arbitrary USSD codes to the carrier - potentially triggering SIM-level operations, device resets, or further privilege escalation. No public exploit code has been identified at time of analysis.