{"id":"CVE-2026-28625","published":"2026-10-05T19:17:19.817","lastModified":"2026-10-07T13:09:21.457","description":"In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":["google"],"products":["android"],"references":[{"url":"https://source.android.com/docs/security/bulletin/aaos/2026/2026-10-01","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows local privilege escalation on Android devices due to a permission bypass flaw in Google's implementation. An attacker with local access can gain elevated privileges without needing additional execution privileges or user interaction.","exploitability":"Exploitation is straightforward requiring only local access with no user interaction needed, making it highly practical for attackers who already have a foothold on the device.","blast_radius":"The impact could be significant across Android devices that implement the affected Google components, potentially allowing attackers to gain full system access from a local shell or app context.","remediation":"Upgrade to Android 15 or later, as this version includes the fix for this permission bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","android","local-attack"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:58:17.919Z"}}