CVE-2026-28582: Security vulnerability
Published Sep 8, 2026
·Updated
In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Event History
Sep 8, 2026
CVE Published
via MITRE·06:04 PM
Data Sourced
via MITRE·06:04 PM
DescriptionWeakness
Frequently Asked Questions
1
Can an attacker exploit this without elevated execution privileges or user interaction?
Yes. Exploitation requires no additional execution privileges and does not require user interaction, but it is a local issue.
2
What can a successful attacker do?
A successful attacker may gain unauthorized access to and modify device credentials, resulting in local information disclosure.