Android CVE-2026-28640

Exploitation requires local code execution on the device with at least low privileges (CVSS PR:L) - in practice, a malicious or compromised app already installed and running. The flaw lies in the checkCallerIsCertInstallerOrSelfInProfile method of CredentialStorageActivity, so the attacker must be able to reach that credential-storage activity interface and exploit the improper caller-identity validation (CWE-20). No user interaction is required (UI:N) and no additional execution privileges are needed, but the local-access and pre-existing-privilege requirements are the key limiting factors preventing remote or zero-privilege exploitation. Affected scope is Android 14, 15, and 16; devices patched per the referenced October 2026 bulletin are not vulnerable.

This is a legitimately high-severity local privilege escalation (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but the signals collectively indicate a lower real-world urgency than the base score alone suggests. The CVSS vector requires local access and existing low privileges (PR:L), meaning an attacker must already have code running on the device - typically a malicious or compromised app. SSVC confirms this picture: Exploitation=none (no observed or public exploitation), Automatable=no, and Technical Impact=total. No KEV listing and no POC were reported, so exploitation status is 'no public exploit identified at time of analysis.' EPSS was not provided in the input, so probability-of-exploitation cannot be quantified. There is no conflict between signals - all point to a serious-but-not-actively-exploited bug fixed through routine Android security bulletin maintenance. Priority should be driven by Android's standard patch cadence rather than emergency response, though the 'total' technical impact and lack of required user interaction make it a meaningful target for malware seeking privilege escalation.

A user installs a malicious or trojanized Android application that runs with normal low privileges. The app invokes CredentialStorageActivity and abuses the flawed checkCallerIsCertInstallerOrSelfInProfile validation to bypass the caller-identity permission check, gaining elevated privileges without any user interaction. No public proof-of-concept was reported at the time of analysis.