Google Android: Permission bypass in uninstall button logic leads to local privilege escalation
Summary
A logic error in the Settings controller ApplicationActionButtonsPreferenceController on Android Automotive OS allows a permission bypass. A local attacker with an existing low-privileged account, app or foothold could escalate privileges on the device. No user interaction is required, and according to Google the rating assumes platform mitigations are disabled or bypassed.
Affected
- Android Automotive OS (AAOS) versions 14, 15 and 16-qpr2 (per the AAOS bulletin)
- Versions not listed are reported as unaffected by the vendor data; the default status is unaffected.
Fixed in
- Fixed in the October 2026 security patch level (AAOS bulletin: 2026-10-05 or later; detail section headed 2026-10-01). The exact threshold is unclear; confirm with the vehicle manufacturer.
- Exact fixed AOSP build numbers: Unknown.
Workaround
Unknown. No workaround is documented in the sources reviewed. Install an update with the October 2026 patch level.
Exploitation
- Not known to be exploited in the wild.
- Not marked as known exploited in CISA ADP Vulnrichment data; no CISA KEV entry found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found in the sources reviewed.
Our recommendation
- Identify any AAOS-based vehicles or devices in use and ask the OEM for the date of the October 2026 update.
- Check Android devices in the fleet against the October 2026 security patch level.
- Restrict installation of unmanaged apps on managed Android devices to reduce the chance of a local foothold.
- Re-check NVD and the vendor bulletin for changes to the CVSS score, affected versions or exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin—October 2026 (AAOS) source.android.com
- Android Security Bulletin—October 2026 source.android.com
- CVE-2026-28641 CVSS and SSVC data (Vulnrichment) vulners.com
- CVE-2026-28641 CISA ADP Vulnrichment hol.org
- CVE-2026-28641 threat intelligence record cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:30.
Original description (NVD)
In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.