CVE-2026-28615: Android Telecomm Privilege Escalation – Patch Now

Technical summary

A permissions bypass flaw exists in Android's Telecomm system service (CWE-862: Missing Authorization). An attacker with local code execution at the user privilege level can circumvent the Android permission framework that normally guards phone call initiation. The vulnerability does not require elevated privileges or user interaction, meaning a malicious app or compromised process running in the standard user context can trigger unauthorized call initiation. The CVSS 3.1 score of 7.8 reflects the high impact across confidentiality, integrity, and availability within the affected process's security boundary.

Business impact

Organizations that deploy Android devices—particularly in BYOD programs, enterprise environments, or managed device fleets—face direct operational and reputational risk. Unauthorized phone calls initiated by malware could enable social engineering attacks, facilitate fraud (e.g., toll fraud or premium-rate number dialing), enable surveillance, or provide attackers a covert communication channel. In regulated sectors (healthcare, finance, government), unauthorized communications may trigger compliance violations and audit findings. The ease of exploitation amplifies the threat: any installed app with network or system access could potentially trigger this flaw.

Affected systems

Google Android devices are affected. The vulnerability resides in the Telecomm system service, which handles phone call functionality across all Android versions and device models that include this component. Determine your specific affected firmware versions and device models by consulting Google's security advisory and cross-referencing your device manifest. Pre-installed, system, and third-party apps that interact with the Telecomm API may be vectors for exploitation.

Exploitability

Exploitability is high. The vulnerability requires only local code execution with standard user privileges—no additional capabilities or dangerous permissions are needed. No user interaction is required; the attack is automated once code execution is achieved. This means any app with basic network, location, or system permissions could potentially craft the exploit. The low barrier to exploitation makes this a likely target for malware authors and a priority for attackers seeking persistent device compromise.

Remediation

Apply the security patch from Google for your Android version as soon as it is available. Check the Android Security & Privacy Release Bulletins for the specific patch version targeting CVE-2026-28615. For BYOD and managed environments, push patches through your MDM/EMM platform or enforce automatic system updates. In parallel, review installed apps for suspicious behavior, apply the principle of least privilege to app permissions, and consider restricting Telecomm API access through SELinux policies if your organization manages custom Android builds.

Patch guidance

Monitor Google's official Android security advisories for patch availability and version numbers. Patches will typically be issued as monthly security updates or emergency out-of-cycle releases. Verify patch status by checking the Android version and security patch level on affected devices (Settings > About Phone > Android version and Security patch level). For enterprise deployments, coordinate patching through your MDM solution to ensure device compliance and minimize disruption. Test patches in a staging environment before broad deployment.

Detection guidance

Monitor system logs and security audit trails for unexpected Telecomm component access, especially from third-party apps. Look for unusual call initiation events that lack user interaction markers or originate from non-dialer apps. Endpoint Detection and Response (EDR) tools should flag process interactions with Telecomm APIs outside normal baselines. Network monitoring can detect anomalous outbound calls or sms traffic. On rooted/unlocked devices, inspect SELinux denial logs for Telecomm permission violations. Incorporate signature-based detection of apps known to exploit this flaw once threat intelligence becomes available.

Why prioritize this

Assign this vulnerability maximum priority due to the combination of high CVSS severity (7.8), trivial exploitation requirements (no special privileges, no user interaction), and direct path to local privilege escalation in a core system service. The wide attack surface (any locally executing app) and potential for abuse across fraud, surveillance, and lateral movement scenarios make immediate patching essential. Organizations should treat this as a critical security update, especially in environments where device compromise is possible (e.g., public or shared devices).

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L) requiring device compromise; low complexity (AC:L) with straightforward exploitation; low privilege requirement (PR:L) needing only standard user context; no user interaction (UI:N); and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The lack of a KEV entry does not reduce the actual risk—it indicates the vulnerability has not yet been observed in active exploitation campaigns in the public record, but the technical characteristics make weaponization highly probable.

Frequently asked questions