CVE-2026-28641

Summary

The flaw allows local privilege escalation by bypassing permission checks in Android's application management UI, potentially enabling attackers to uninstall system applications without proper authorization.

Exploitability

Exploitation is straightforward requiring only local access with user privileges, no additional execution privileges or user interaction needed for the attack to succeed.

Blast radius

The impact could be significant across all Android devices where this permission bypass exists, potentially allowing attackers to remove critical system applications and compromise device integrity.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Android 14.0.0.0 (API level 34) or later, which contains the fixed version of ApplicationActionButtonsPreferenceController.java

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.