CVE-2026-28622: Security vulnerability
Published Sep 8, 2026
·Updated
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Event History
Sep 8, 2026
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
DescriptionWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
Exploitation is local and does not require additional execution privileges.
2
Is user interaction required?
No. The issue can be exploited without user interaction.
3
What data could be exposed?
An attacker may be able to retrieve location metadata.