{"id":"CVE-2026-28640","published":"2026-10-05T19:17:19.957","lastModified":"2026-10-07T13:08:48.297","description":"In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":["google"],"products":["android"],"references":[{"url":"https://source.android.com/docs/security/bulletin/aaos/2026/2026-10-01","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a permission bypass in Android's credential storage system that allows local attackers to escalate privileges without needing additional execution privileges. This occurs due to improper input validation in the CredentialStorageActivity.java file.","exploitability":"Exploitation is relatively straightforward as it requires only local access with existing user privileges, no user interaction or additional execution privileges are needed for successful privilege escalation.","blast_radius":"The impact could be significant across all Android devices that use the affected credential storage functionality, potentially allowing attackers to gain full system-level access to sensitive credential management features.","remediation":"Upgrade to Android 14 or later, as this vulnerability affects Android versions prior to 14 and the fix is included in the Android 14 release.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","android","credential-management"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:58:11.612Z"}}