CVE-2026-28647

Summary

The flaw allows local users to bypass permission checks in Android's device admin settings, potentially enabling privilege escalation without requiring additional execution privileges or user interaction.

Exploitability

Exploitation is relatively straightforward as it requires only local access with existing user privileges, and no user interaction is needed for the exploit to succeed.

Blast radius

The impact could be significant across Android devices where users have local access, potentially allowing attackers to gain elevated privileges and access restricted system functions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Android 14 or later, as this vulnerability affects Android versions prior to 14 and the fix is included in the Android 14 release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.