CVE-2026-28580 Overview
CVE-2026-28580 is a local privilege escalation vulnerability affecting Google Android 16.0, including QPR2 Beta 1, 2, and 3 builds. The flaw stems from an incorrect bounds check across multiple functions, leading to a desync condition in persistence handling. An attacker with low-privileged local access can exploit the issue to escalate privileges without user interaction. The vulnerability is categorized under [CWE-120] (Buffer Copy without Checking Size of Input). Google addressed the issue in the June 2026 Android Security Bulletin.
Critical Impact
Local attackers can escalate privileges on affected Android 16.0 devices without user interaction or additional execution privileges.
Affected Products
- Google Android 16.0
- Google Android 16.0 QPR2 Beta 1, Beta 2, Beta 3
- Devices running unpatched Android 16.0 builds prior to the June 2026 security patch level
Discovery Timeline
- 2026-06-01 - Google publishes the Android Security Bulletin June 2026
- 2026-06-01 - CVE-2026-28580 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-28580
Vulnerability Analysis
The vulnerability resides in multiple Android system functions that handle persistence operations. An incorrect bounds check creates a desynchronization condition between expected and actual data boundaries. This desync allows a local process to manipulate persisted state in ways the system does not anticipate. The result is local privilege escalation reachable from an unprivileged context.
The [CWE-120] classification points to a classic buffer copy without proper size validation. When the affected functions handle persistence data, the mismatch between validated and copied lengths permits memory corruption or state confusion. Exploitation requires no user interaction, which removes a common mitigating factor for local attacks on mobile platforms.
Root Cause
The root cause is an incorrect bounds check used across multiple persistence-related functions. The check does not enforce the same boundary that subsequent operations assume, producing a desync between validation and use. This logic gap enables an attacker to drive the affected code paths into an inconsistent persisted state. Google has not publicly released the specific source file or function names in the bulletin.
Attack Vector
Exploitation requires local access with low privileges, such as code execution inside a third-party application sandbox. The attacker invokes the affected persistence functions with crafted inputs that pass the flawed bounds check. Because the validation does not match downstream assumptions, the attacker can corrupt or desynchronize persistent state. The final outcome is privilege escalation to a higher-privileged context on the device.
See the Android Security Bulletin June 2026 for vendor-confirmed technical details. No public proof-of-concept code has been published at this time.
Detection Methods for CVE-2026-28580
Indicators of Compromise
- Unexpected processes running with elevated UIDs originating from third-party application sandboxes
- Anomalous modifications to system persistence stores or configuration databases by non-system UIDs
- Crash signatures in logcat or tombstones referencing bounds-check failures in persistence-handling components
Detection Strategies
- Monitor Android devices for security patch level below the June 2026 bulletin (2026-06-01) using MDM or EMM inventory data
- Correlate SELinux denials and audit logs for unexpected access patterns to system persistence interfaces
- Hunt for applications that invoke unusual sequences of system service calls associated with persistent state writes
Monitoring Recommendations
- Enforce mobile device compliance policies that flag devices not at the June 2026 or later Android security patch level
- Stream Android device telemetry, including SELinux audit events, into a centralized analytics platform for review
- Track third-party application behavior for privilege transitions inconsistent with declared manifest permissions
How to Mitigate CVE-2026-28580
Immediate Actions Required
- Apply the June 2026 Android security patch level (2026-06-01) or later on all Android 16.0 devices
- Remove or restrict Android 16.0 QPR2 Beta builds from production fleets until updated to the patched release
- Audit installed third-party applications and remove those from untrusted sources that could deliver a local exploit
Patch Information
Google released the fix in the Android Security Bulletin June 2026. Devices reporting a security patch level of 2026-06-01 or later include the remediation. OEM rollouts vary, so administrators should validate patch availability per device model through the respective vendor channels.
Workarounds
- Restrict installation to vetted applications via managed Google Play and block sideloading on managed devices
- Use mobile device management policies to enforce minimum patch level requirements for corporate resource access
- Isolate sensitive workloads on devices confirmed to be running patched Android builds
# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for remediation: 2026-06-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
