CVE-2026-28586: Android AppOpsService Permission Bypass Leading to Information Disclosure

Technical summary

Multiple functions in AppOpsService.java fail to enforce proper permission validation before granting access to protected information. The vulnerability manifests as a permissions bypass (CWE-269) that enables a local, authenticated principal to circumvent access controls. The absence of required permission checks allows disclosure of app operation data that should be restricted. Exploitation requires no additional privileges beyond a local user account and no user interaction is required.

Business impact

The primary risk is unauthorized disclosure of app usage and permission data stored within AppOpsService. For enterprises, this could expose employee or user behavior patterns and reveal which applications are installed or actively requesting sensitive permissions. The low CVSS score reflects limited scope—data confidentiality is impacted but integrity and availability are unaffected. Organizations heavily reliant on Android for employee mobility should still assess whether app usage patterns constitute sensitive business information in their environment.

Affected systems

This vulnerability affects multiple versions of Google Android. Verification of the exact affected Android versions and patch release dates should be confirmed against the official Google Android Security & Privacy Year In Review and vendor advisories, as version-specific data requires cross-reference with Google's official security bulletins.

Exploitability

Exploitation is relatively straightforward for an attacker with local device access. No special tools, remote network access, or user interaction are required—a local user can directly invoke the vulnerable AppOpsService functions to bypass permission checks. However, the attacker must already possess legitimate credentials to access the device. The barrier to exploitation is low only in terms of technical complexity; the requirement for pre-existing local authentication significantly constrains real-world attack scope.

Remediation

Apply the security patch released by Google for your affected Android version. Verify the patch version against Google's official security advisory to ensure you're installing the correct build. Organizations should prioritize this update for devices that support it, though the low severity allows for standard update cycles rather than emergency patching.

Patch guidance

Consult Google's official Android Security & Privacy update bulletins to identify the patched Android version corresponding to your current build. The patch restores proper permission validation in AppOpsService.java functions. Organizations should test patches in a staging environment before broad deployment, though the low severity permits standard change windows. Devices running unsupported Android versions will not receive patches and should be evaluated for device lifecycle replacement.

Detection guidance

Audit logs on Android devices may show unexpected or repeated queries to AppOpsService from unprivileged processes if exploitation is occurring. Mobile device management (MDM) solutions can verify that all managed devices are running patched Android versions. Runtime behavior monitoring for excessive AppOpsService access by non-system applications could help detect active exploitation, though this requires device-level monitoring tools.

Why prioritize this

This vulnerability merits standard-priority handling rather than emergency response. The CVSS 3.3 (LOW) score reflects the requirement for local authentication, limited data exposure, and absence of system compromise. Prioritize patching after addressing any critical or high-severity vulnerabilities, but include it in your regular monthly patch cycle. Organizations with strict data governance around app usage patterns may justify faster patching.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects: Attack Vector: Local (AV:L) because remote exploitation is impossible; Access Complexity: Low (AC:L) because no special conditions are needed beyond local access; Privileges Required: Low (PR:L) because an authenticated user account is necessary; User Interaction: None (UI:N) because the attack requires no user action; Confidentiality Impact: Low (C:L) because only app operations data is disclosed. Integrity and Availability are unaffected. The low score is appropriate given the local-only attack surface and constrained data exposure, though organizations handling sensitive app metadata should consider context-specific risk elevation.

Frequently asked questions