Google Android CVE-2026-28643

Exploitation requires local access to the device - per AV:L, this is a locally-installed app or on-device actor, not a remote network attacker. The flaw is a missing permission check reachable 'in multiple locations' (per the Android bulletin boilerplate), so no additional execution privileges and no user interaction are needed (PR:N/UI:N). Impact is limited to denial of service (A:H only; C:N/I:N) affecting the device's availability, with no data disclosure or code execution. Limiting factors: the attacker must already be able to run code on the device, and the affected versions are Android 16, 16-qpr2, and 17 - devices on other branches or already patched per the 2026-11-01 bulletin are not exposed. The specific vulnerable component is not named in the available sources.

This is a moderate-severity local availability issue, not an urgent remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.2) confirms the attack is LOCAL, not network-reachable, with impact confined to availability (denial of service) and no confidentiality or integrity loss. On Android, AV:L with PR:N realistically means a malicious or malformed local app (or on-device actor) can trigger the condition without holding special execution privileges. The supporting signals all point to low real-world urgency: EPSS is 0.11% (1st percentile), there is no CISA KEV listing (not a US agency scope product), and no public exploit or PoC reference is present in the input. The vuln.today decision label is 'this_month' - a routine patch cadence, not act_now or emergency. These signals are consistent with one another: a low-probability, locally-scoped DoS that should be remediated on a normal monthly cycle rather than treated as an active-exploitation emergency. No signals conflict. The main caveat is detail: the description is Android's generic boilerplate ('in multiple locations, missing permission check') and does not name the specific component, so the precise trigger cannot be verified from available sources.

A malicious application installed on the device, running with no special permissions, invokes an interface that is missing a permission check and supplies input that crashes or hangs the affected component, producing a local denial of service. No user interaction is required. No public exploit code or PoC reference is present in the input.