CVE-2026-28625

Summary

This vulnerability allows local privilege escalation on Android devices due to a permission bypass flaw in Google's implementation. An attacker with local access can gain elevated privileges without needing additional execution privileges or user interaction.

Exploitability

Exploitation is straightforward requiring only local access with no user interaction needed, making it highly practical for attackers who already have a foothold on the device.

Blast radius

The impact could be significant across Android devices that implement the affected Google components, potentially allowing attackers to gain full system access from a local shell or app context.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Android 15 or later, as this version includes the fix for this permission bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.