CVE-2026-28640

Summary

The flaw is a permission bypass in Android's credential storage system that allows local attackers to escalate privileges without needing additional execution privileges. This occurs due to improper input validation in the CredentialStorageActivity.java file.

Exploitability

Exploitation is relatively straightforward as it requires only local access with existing user privileges, no user interaction or additional execution privileges are needed for successful privilege escalation.

Blast radius

The impact could be significant across all Android devices that use the affected credential storage functionality, potentially allowing attackers to gain full system-level access to sensitive credential management features.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Android 14 or later, as this vulnerability affects Android versions prior to 14 and the fix is included in the Android 14 release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.