Android Settings CVE-2026-28641

Exploitation requires an attacker to already possess local, low-privileged execution on the device (PR:L) - for example a malicious or compromised app running in a standard app sandbox - so this is not remotely reachable and not exploitable by an unauthenticated network attacker. The specific trigger is reaching the shouldDisableUninstallButton logic in ApplicationActionButtonsPreferenceController (the Settings application-management UI/controller), where a logic error causes a permission check to be bypassed. No user interaction is required (UI:N), which removes a common limiting factor. Limiting factors that reduce realistic risk: the mandatory pre-existing local foothold, the confinement of affected versions to Android 14, 15, and 16-qpr2, and that the referenced advisory is the Android Automotive OS bulletin, which may narrow the practically affected deployment surface.

This is a credible, actionable local privilege-escalation issue but not an emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) indicates an attacker must already have local, low-privileged code execution on the device (PR:L) but then needs no user interaction and faces low complexity to achieve total compromise of confidentiality, integrity and availability within the component scope. Multiple lower-urgency signals align and reinforce each other: SSVC from CISA reports Exploitation: none, Automatable: no, and Technical Impact: total - meaning high per-device impact but no evidence of weaponization and no scalable mass-exploitation path, which is consistent with a local-only vector. There is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are mutually consistent (high impact, local access, not automatable, no known exploitation) rather than conflicting, so this reads as a genuine patch-worthy privilege-escalation bug rather than an inflated high-CVSS/low-real-risk finding - but its priority is bounded by the local-access prerequisite, meaning it is realistically a second-stage escalation primitive rather than an initial-access vulnerability.

A malicious or compromised low-privileged app already installed on an Android device invokes the vulnerable uninstall-button logic path in the Settings component, abusing the flawed shouldDisableUninstallButton permission check to perform an action it should not be permitted to. Because no user interaction is required, this happens silently to elevate privileges locally. No public exploit code has been identified at the time of analysis.