CVE-2026-28580: High severity Google Android vulnerability
In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict local interactive logon and console access to trusted administrative accounts only. Use host-based access controls (local policy, PAM, or equivalent) to prevent non-privileged users from performing actions that could lead to privilege changes.
- Compensating control
Limit and monitor use of administrative/shared/local accounts; disable or remove unneeded local accounts and ensure unique, least-privilege accounts are used for administration.
- Operational
Audit system and security logs for signs of privilege escalation or suspicious activity on affected hosts; investigate and contain any anomalies. If compromise is suspected, rotate credentials and keys for impacted accounts.
- Operational
Track vendor advisories for this issue and apply any vendor-supplied patches or updates as soon as they are released. Test and deploy vendor fixes promptly when available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28580?
CVE-2026-28580 has a high severity rating of 7.8 based on the CVSS 3.1 metrics.
How do I fix CVE-2026-28580?
To fix CVE-2026-28580, update your Google Android device to the latest security patch provided by Google.
What are the potential impacts of CVE-2026-28580?
CVE-2026-28580 could lead to local escalation of privilege, allowing an attacker to gain higher access without additional execution privileges.
Is user interaction required to exploit CVE-2026-28580?
No, user interaction is not needed for the exploitation of CVE-2026-28580.
In what software is CVE-2026-28580 found?
CVE-2026-28580 is a vulnerability found in Google Android.