CVE-2026-28578: Input Validation

Published Jun 1, 2026

Updated

In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

7 affected components

Google Android

Google Android=14.0

Google Android=15.0

Google Android=16.0

Google Android=16.0-qpr2_beta_1

Google Android=16.0-qpr2_beta_2

Google Android=16.0-qpr2_beta_3

Event History

Jun 1, 2026

CVE Published

via MITRE·09:14 PM

Data Sourced

via MITRE·09:14 PM

DescriptionWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-28578?

The severity of CVE-2026-28578 is rated as medium with a CVSS score of 5.5.

What software is affected by CVE-2026-28578?

CVE-2026-28578 affects Google Android.

How can CVE-2026-28578 be exploited?

CVE-2026-28578 can be exploited through a local denial of service without the need for additional execution privileges or user interaction.

What is the root cause of CVE-2026-28578?

CVE-2026-28578 is caused by improper input validation in multiple functions of DevicePolicyManagerService.java.

How do I mitigate the risk of CVE-2026-28578?

To mitigate the risk of CVE-2026-28578, ensure that all relevant software is updated to versions that have addressed this vulnerability.