CVE-2026-28588

Summary

A logic error in ExternalStorageProvider.java's shouldBlockDirectoryFromTree function allows unprivileged local processes to access protected external storage directories without authentication or user interaction, leading to full local confidentiality, integrity, and availability compromise.

Exploitability

Exploitation requires local access and no additional privileges, but the exact method is not disclosed; however, the lack of user interaction and low attack complexity (AV:L/AC:L) suggests it may be straightforward for a compromised or malicious local account.

Blast radius

An attacker with local access could read, modify, or delete sensitive external storage data, potentially compromising all local users on the device and enabling full system compromise via further privilege escalation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the patch released in Android Security Bulletin 2026-04 (or later), which specifically addresses CVE-2026-28588; if no bulletin or fixed version is published, disable external storage access for untrusted local processes until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.