{"id":"CVE-2026-28588","published":"2026-11-02T20:17:41.713","lastModified":"2026-11-03T05:18:42.473","description":"In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A logic error in ExternalStorageProvider.java's shouldBlockDirectoryFromTree function allows unprivileged local processes to access protected external storage directories without authentication or user interaction, leading to full local confidentiality, integrity, and availability compromise.","exploitability":"Exploitation requires local access and no additional privileges, but the exact method is not disclosed; however, the lack of user interaction and low attack complexity (AV:L/AC:L) suggests it may be straightforward for a compromised or malicious local account.","blast_radius":"An attacker with local access could read, modify, or delete sensitive external storage data, potentially compromising all local users on the device and enabling full system compromise via further privilege escalation.","remediation":"Apply the patch released in Android Security Bulletin 2026-04 (or later), which specifically addresses CVE-2026-28588; if no bulletin or fixed version is published, disable external storage access for untrusted local processes until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","external-storage","logic-flaw","android","local-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:02:36.376Z"}}