Google Android Automotive OS: Elevation of privilege in certificate storage settings
Summary
A permission bypass caused by improper input validation in CredentialStorageActivity.java allows a local attacker to escalate privileges on affected Android Automotive OS devices. Exploitation requires no additional execution privileges and no user interaction, but the attacker needs code running on the device, for example a malicious app. The vulnerability is rated High with a CVSS 3.1 score of 7.8.
Affected
- Android Automotive OS 14, 15 and 16 (per Google AAOS bulletin, System component)
- Exact affected build numbers: Unknown.
Fixed in
- Security patch level 2026-10-01 or later (October 2026 Android Security Bulletin); the AAOS bulletin also refers to 2026-10-05 or later.
- Exact fixed build numbers: Unknown.
Workaround
- No vendor workaround documented. Apply the October 2026 security update.
Exploitation
- No evidence of active exploitation found. Not listed in CISA KEV.
- No public proof-of-concept found in the sources reviewed.
Our recommendation
- Check the security patch level of all Android Automotive OS devices and confirm it is 2026-10-01 or later; treat unknown-patch devices as unpatched.
- Ask your OEM or fleet vendor to deploy the October 2026 update.
- Restrict installation of untrusted apps and manage device access, since local access is required for exploitation.
- Prioritise fleet and infotainment systems; standard Android devices should be checked separately to confirm whether they are affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin—October 2026 (AAOS) source.android.com
- Android Security Bulletin—October 2026 source.android.com
- CVE-2026-28640 at ThreatInt cve.threatint.com
- CVE-2026-28640 CISA ADP Vulnrichment hol.org
- CVE-2026-28640 Vulners Vulnrichment vulners.com
- Car Settings commit with CredentialStorageActivity.java android.googlesource.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:34.
Original description (NVD)
In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.