CVE-2026-28580: Android Local Privilege Escalation via Bounds Check Flaw

Technical summary

This vulnerability involves a desynchronization flaw in persistence mechanisms across multiple functions within Android, caused by inadequate bounds validation. The CWE-120 classification (buffer copy without checking size of input—'classic buffer overflow') indicates that improper size checks allow out-of-bounds operations. An attacker with local access can trigger this condition to corrupt or manipulate privileged state, crossing privilege boundaries without needing execute-level permissions initially. The attack surface is local-only; there is no network component.

Business impact

Device compromise poses significant risk to enterprise deployments. An attacker gaining local escalation can access sensitive user data, modify system settings, install persistent malware, or intercept communications. For organizations managing Android devices—especially in bring-your-own-device (BYOD) environments—this vulnerability could allow lateral movement to corporate networks if the device is trusted. The lack of user interaction required means exploitation can occur silently during normal device operation, making detection and attribution difficult.

Affected systems

Google Android is the affected platform. The vulnerability affects multiple functions within the persistence subsystem. All Android versions and devices running vulnerable code are potentially at risk; consult Google's security advisory for precise version coverage and affected device models. This includes stock Android and device-specific implementations that have not yet received patches.

Exploitability

Exploitability is straightforward for a local attacker. The attack requires only basic user-level privileges on the device—no special system permissions, physical interaction, or social engineering is required. The vulnerability is triggered through normal system calls or application behavior that interacts with the affected persistence functions. Because no user interaction is needed, the exploitation window is wide: a malicious app or compromised process can trigger the flaw automatically. The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of easy local access, complete confidentiality/integrity/availability impact, and absence of user interaction.

Remediation

Apply security updates from Google as soon as they become available. Google typically delivers Android patches monthly via the Android Security & Maintenance Release (ASMR) bulletin. Device manufacturers and carriers may introduce additional delays. For organization-managed devices, enforce policy requiring devices to be running the latest security patch level. Check the official Android Security & Maintenance bulletin at source.android.com/security for patch release dates and affected version ranges.

Patch guidance

Monitor Google's official Android security advisories for the specific patch version addressing CVE-2026-28580. Patches are typically delivered to Pixel devices first, followed by broader rollout to carrier-managed and OEM devices. For enterprise environments, coordinate with device management (MDM) vendors to ensure patch distribution policies automatically deploy updates. Verify patch application by checking the device's security patch level in Settings > About Phone > Android Security & Maintenance Release (or similar, depending on Android version). Consider enforcing a maximum-age policy for security patches in your device security posture.

Detection guidance

Detection at the system level is challenging because the flaw involves in-memory state corruption rather than network activity. Monitor for suspicious privilege escalation events in audit logs (if available on managed devices). On Android, enable and review SELinux denials and privilege escalation attempts via logcat or enterprise logging. Application-level detection is difficult without vendor-supplied detection signatures. Rely primarily on ensuring devices are current with patches and employing endpoint detection and response (EDR) tools that monitor for unusual process behavior after exploitation. Behavioral indicators may include unexpected system service restarts, rapid permission acquisitions, or unusual file system modifications by apps.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity, lack of exploitation barriers, and silent nature. The CVSS 7.8 score reflects complete impact across confidentiality, integrity, and availability. Unlike vulnerabilities requiring specific permissions or user interaction, this flaw can be exploited passively. For organizations deploying Android in security-sensitive roles—healthcare, finance, or government—or managing BYOD fleets, timely patching is critical. The absence of a public exploit does not diminish urgency; local privilege escalation vulnerabilities are frequently weaponized post-disclosure.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is justified by: Attack Vector (Local/AV:L) reflecting the requirement for pre-existing local access; Attack Complexity (Low/AC:L) indicating the flaw is straightforward to trigger; Privileges Required (Low/PR:L) requiring only basic user-level rights; User Interaction (None/UI:N) showing no user action is needed; Scope (Unchanged/S:U) as the impact is confined to the system; and High impact across Confidentiality, Integrity, and Availability (C:H/I:H/A:H) due to complete privilege escalation. The score reflects a serious local threat that does not require exceptional skill or situational luck to exploit.

Frequently asked questions