CVE-2026-28578 Overview
CVE-2026-28578 affects multiple functions of DevicePolicyManagerService.java in Google Android. The vulnerability stems from improper input validation that causes a desynchronization between runtime state and persisted state. A local attacker with low privileges can trigger this condition to cause a denial of service on the device. Exploitation does not require user interaction.
The issue impacts Android 14, 15, and 16, including multiple Android 16 QPR2 beta builds. Google addressed the flaw in the June 2026 Android Security Bulletin.
Critical Impact
A local application with standard permissions can disrupt device policy state and produce a denial of service without user interaction.
Affected Products
- Google Android 14.0
- Google Android 15.0
- Google Android 16.0 (including QPR2 Beta 1, Beta 2, and Beta 3)
Discovery Timeline
- 2026-06-01 - Google publishes the Android Security Bulletin addressing CVE-2026-28578
- 2026-06-01 - CVE-2026-28578 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-28578
Vulnerability Analysis
The flaw resides in multiple functions of DevicePolicyManagerService.java, the Android system service that manages device administration policies. Improper input validation [CWE-20] allows a caller to submit data that the service accepts at runtime but cannot consistently persist. This produces a desynchronization between the in-memory policy state and the on-disk policy state.
When the persisted state diverges from runtime state, downstream policy operations fail or trigger inconsistent service behavior. The result is a denial of service condition that affects the device administration subsystem.
The attack requires only local access and low privileges. No additional execution privileges are granted to the attacker, and no user interaction is required. The confidentiality and integrity impact is none, but availability impact is high.
Root Cause
The root cause is missing or incomplete input validation in policy-handling functions of DevicePolicyManagerService. The service writes policy changes to persistent storage without verifying that the inputs can be safely round-tripped between memory and disk representations. This is a classic CWE-20 weakness in a privileged Android system service.
Attack Vector
A malicious or compromised local application invokes affected DevicePolicyManagerService APIs with malformed inputs that pass initial checks. The service updates in-memory state but fails to persist the data consistently. Subsequent reads or policy enforcement operations encounter the inconsistent state and fail, producing a denial of service against device policy functionality.
The vulnerability manifests in standard Android system service code paths. See the Android Security Bulletin June 2026 for technical details on the affected functions and patch references.
Detection Methods for CVE-2026-28578
Indicators of Compromise
- Repeated crashes or restarts of the system_server process tied to device policy operations
- Unexpected DevicePolicyManagerService exceptions in logcat referencing policy serialization or persistence failures
- Device admin policies reverting to prior states or failing to apply after reboot
- Applications repeatedly invoking DevicePolicyManager APIs with malformed parameters
Detection Strategies
- Monitor Android system logs for DevicePolicyManagerService exceptions and policy persistence errors
- Track applications that issue high-frequency calls to device administration APIs
- Correlate system_server instability with recently installed or updated third-party applications
- Audit enterprise mobility management (EMM) telemetry for policy enforcement gaps across managed devices
Monitoring Recommendations
- Ingest device logs and EMM telemetry into a centralized analytics platform to surface anomalous policy churn
- Establish baselines for DevicePolicyManager API call patterns and alert on outliers
- Track Android patch level (ro.build.version.security_patch) across the device fleet to confirm remediation status
How to Mitigate CVE-2026-28578
Immediate Actions Required
- Apply the June 2026 Android security patch (2026-06-01 security patch level or later) on all affected devices
- Through mobile device management, enforce minimum patch level policies that block devices below the June 2026 baseline
- Review installed applications on managed devices and remove untrusted apps that request device administration capabilities
Patch Information
Google released the fix in the Android Security Bulletin June 2026. Devices reporting a security patch level of 2026-06-01 or later contain the remediation. OEM rollouts vary, so verify the patch level on each device model after the vendor update is delivered.
Workarounds
- Restrict installation of applications from untrusted sources via MDM policy until patches are deployed
- Limit which applications can request the BIND_DEVICE_ADMIN permission on managed devices
- Reboot affected devices to restore consistent policy state if a desynchronization is suspected, pending patch deployment
# Verify Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-06-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
