CVE-2026-28597
8.4 HIGHPublished 2026-11-02 · Updated 2026-11-03
AI risk analysis
- Summary
- The flaw allows a local attacker to bypass permission checks when granting URI access, enabling unauthorized read/write access to protected resources without user interaction or elevated privileges.
- Exploitability
- Exploitation requires local access to the device and knowledge of the vulnerable API; no additional privileges or user interaction are needed.
- Blast radius
- Successful exploitation could lead to full compromise of local confidentiality, integrity, and availability for the affected device.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Android version with patch level 2026-04-05 or later, as this vulnerability was fixed in that release.
permission-bypasslocal-privilege-escalationandroidcwe20
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-107017PoC
- HIGHCVE-2026-28641
- HIGHCVE-2026-28647
- HIGHCVE-2026-58841
- HIGHCVE-2026-58873
- HIGHCVE-2026-58884
- HIGHCVE-2026-58934
- HIGHCVE-2026-58946
Related by shared AI tags and CWE weakness class. Browse the full archive.