CVE-2026-28573: Missing Permission Check in Android Manifest Causes Denial of Service

Technical summary

The vulnerability exists in AndroidManifest.xml handling on Google Android and Samsung Wear OS. It is caused by insufficient permission checks (CWE-862) that fail to validate user privileges before processing manifest directives. The CVSS v3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local vector, low complexity, low privilege requirement, and high impact to availability. An attacker with basic user-level privileges can invoke the vulnerable code path without user interaction to trigger persistent denial of service conditions.

Business impact

Organizations deploying Android or Wear OS devices in production environments may experience unexpected service unavailability if this flaw is exploited by a malicious app or compromised account. In enterprise environments managing fleets of Android devices, widespread exploitation could degrade operational continuity, increase support burden, and require emergency patching cycles. Consumer devices could be rendered unusable until the system is rebooted or reinstalled, though the impact is temporary and localized to individual devices.

Affected systems

This vulnerability affects Google Android and Samsung Wear OS. Specific version ranges and patch availability should be verified against vendor advisories, as only the general product families are confirmed in public disclosures. Both mainstream consumer and enterprise-deployed instances of these platforms warrant assessment.

Exploitability

Exploitation requires local access—the attacker must already have user-level code execution on the device, such as through a sideloaded malicious app or a compromised user account. No additional privilege escalation is needed, and the attack requires no user interaction. The low attack complexity means that once initial access is achieved, the denial of service can be reliably triggered, making it a practical post-compromise persistence or sabotage vector.

Remediation

Apply security patches from Google and Samsung once available. Vendors typically address manifest validation flaws through systematic permission check additions during the manifest parsing phase. Organizations should prioritize patching systems that run untrusted or third-party applications. As an interim measure, restrict app installation to trusted sources and monitor system stability for unexpected crashes.

Patch guidance

Check Google's Android Security & Privacy Year in Review bulletins and Samsung's security updates page for the specific CVE-2026-28573 patches and affected OS versions. Patches will likely roll out through Google Play System Updates and Samsung Monthly Security Updates; ensure devices are set to receive automatic updates or manually check for updates in Settings > About > System Update. Verify patch installation by confirming the security patch date exceeds the June 2026 publication window.

Detection guidance

Monitor for unexpected service crashes or repeated system-level process terminations on Android and Wear OS devices, particularly if they correlate with app installations or configuration changes. Log analysis should flag repeated manifest parsing errors or denial of service events. On managed devices, mobile device management (MDM) solutions can alert on system stability degradation. Threat detection should look for suspicious apps requesting unusual system-level permissions or attempting to manipulate manifest files.

Why prioritize this

Although CVSS assigns a medium score, the practical risk depends on organizational context. Enterprises with open app stores or allow-list policies face higher risk; consumer users benefit from app store curation. Prioritize patching if your environment permits sideloaded or third-party apps, or if device compromise is a plausible threat model. The lack of KEV designation suggests active in-the-wild exploitation is not yet documented, reducing immediate urgency but not eliminating the need for timely patching.

Risk score, explained

CVSS 5.5 (Medium) reflects the attack vector (local only), low complexity, and requirement for low privileges balanced against complete availability impact. The score does not account for business context—enterprises managing thousands of devices could face higher practical risk from large-scale exploitation, while isolated devices present lower absolute impact. The absence of confidentiality or integrity impact limits the severity ceiling.

Frequently asked questions