CVE-2026-28587: Critical severity Google Android MmsSmsProvider vulnerability
In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify MmsSmsProvider.java to perform and enforce an appropriate permission check (verify caller has the required permission) prior to disclosing any sensitive information via the provider. Ensure all code paths that return data validate permissions.
MmsSmsProvider (MmsSmsProvider.java) permission_check = enforce a permission check before returning sensitive information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28587?
The severity of CVE-2026-28587 is rated as critical with a CVSS score of 10.
How do I fix CVE-2026-28587?
To address CVE-2026-28587, update the affected software to the latest version provided by Google.
What kind of impact does CVE-2026-28587 have?
CVE-2026-28587 can lead to local information disclosure due to a missing permission check.
Is user interaction required to exploit CVE-2026-28587?
No, user interaction is not needed for the exploitation of CVE-2026-28587.
Which software is affected by CVE-2026-28587?
CVE-2026-28587 affects Google Android MmsSmsProvider as part of the Android operating system.