Google Android: Local privilege escalation via permission bypass
Summary
A logic error in several locations of the Android system component allows a permission bypass. A local attacker with low privileges, for example a malicious installed app, can escalate privileges to a higher level. No user interaction is required, and the vulnerability is not remotely exploitable from the internet.
Affected
- Android 14, 15, 16, 16-qpr2 and 17 (per AOSP advisory)
- Android Automotive OS: see AAOS bulletin 2026-10-01
- Android 14 is listed as unaffected by the CVE record default, but the AOSP bulletin lists it as affected
Fixed in
- Security patch level 2026-10-01 or later (Android Security Bulletin October 2026)
- AAOS: patch level 2026-10-05 or later plus all issues in the AAOS bulletin
- Exact AOSP build tags and commit IDs: Unknown.
Workaround
Unknown. No workaround is documented in the sources reviewed.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- No public proof-of-concept found
- Not reported as actively exploited in the wild
- Not listed in CISA KEV
- EPSS 0.00071 (very low)
Our recommendation
- Apply the Android security patch level 2026-10-01 or later on all mobile devices and check the patch level on each device
- For Android Automotive OS head units, install the AAOS update with patch level 2026-10-05 or later
- Prioritise devices used in BYOD, shared or fleet scenarios where untrusted apps or users may be present
- Check OEM bulletins (e.g. Samsung, Pixel) for vendor-specific builds
- Restrict installation of apps to trusted sources and monitor for suspicious apps
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin October 2026 (AAOS) source.android.com
- Android Security Bulletin October 2026 source.android.com
- Vulners VulnRichment CVE-2026-28625 vulners.com
- GovCERT.HK alert www.govcert.gov.hk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:33.
Original description (NVD)
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.