Android CVE-2026-28658

Physical access to an Android 14-17 device that has been factory reset and is in the FRP setup/enrollment flow, where findMetaAuthUid in AccountsDb.java is invoked to verify account ownership. The CVSS PR:L metric indicates that some minimal local privilege or interaction with the device enrollment workflow is required - this is consistent with the attacker needing to operate the device UI to reach the vulnerable code path. No third-party user interaction is required. Exploitation is strictly local (AV:L); remote exploitation is not possible without prior physical access. No non-default configuration is required - any factory-reset Android device on an affected version reaching the FRP verification step is potentially vulnerable. The key limiting factors are physical access to the device and the requirement to trigger the specific FRP enrollment flow.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the description: local exploitation requiring minimal existing privileges, no user interaction, and delivering total device compromise. EPSS at 0.13% (3rd percentile) indicates very low automated exploitation likelihood, and SSVC confirms 'Automatable: no' - exploitation requires physical interaction with the device setup flow, not mass network-based scanning. However, SSVC's 'Technical Impact: total' underscores that when this flaw is triggered, the attacker achieves complete control. The absence of a KEV listing and no identified POC reduce immediate urgency for enterprise patch prioritization, though FRP bypasses historically attract sustained interest from device-theft ecosystems and targeted scenarios. Even a mid-sized municipal IT department in rybnik managing a shared Android device fleet should treat this September 2026 patch cycle as high priority given the total technical impact against devices subject to physical-layer threats.

An attacker steals or finds an Android device (versions 14-17), performs a factory reset, then exploits the findMetaAuthUid logic error during the FRP account verification screen to bypass the ownership check without supplying the original Google account credentials. The attacker gains full owner-level access to all data, applications, and credentials on the device. No exploit code is publicly known, but the technique follows established FRP bypass research patterns on prior Android versions.