CVE-2026-28573: Critical severity Google Android vulnerability
In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify AndroidManifest.xml to enforce a permission check for the affected component(s). For components that must be exported, add an appropriate android:permission (or require a custom permission) so unprivileged local apps cannot invoke them. For components that do not need external access, set android:exported="false".
Android application (AndroidManifest.xml) permission enforcement on exported components = require appropriate permission for the affected exported components
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28573?
CVE-2026-28573 has a risk rating of 20, indicating a high-severity vulnerability.
How do I fix CVE-2026-28573?
To fix CVE-2026-28573, ensure that the appropriate permission checks are implemented in the AndroidManifest.xml file.
What type of vulnerability is CVE-2026-28573?
CVE-2026-28573 is classified as a denial of service vulnerability in Android.
Can CVE-2026-28573 be exploited without user interaction?
Yes, CVE-2026-28573 can be exploited without any user interaction required.
What potential impact does CVE-2026-28573 have?
CVE-2026-28573 could lead to a persistent local denial of service on affected devices.