CVE-2026-28590 Overview
CVE-2026-28590 is an improper encryption key validation flaw affecting Android, disclosed in the Android Security Bulletin for September 2026. The issue stems from a logic error in code responsible for validating cryptographic keys across multiple locations in the platform. A local attacker with low privileges can exploit the weakness to escalate privileges on an affected device. No user interaction is required, which lowers the barrier for on-device malware to abuse the flaw. The vulnerability is categorized under [CWE-347] (Improper Verification of Cryptographic Signature).
Critical Impact
A local, low-privileged process can bypass encryption key validation and escalate privileges on affected Android devices without user interaction.
Affected Products
- Android (versions covered by the September 2026 Android Security Bulletin)
- Specific component and version details are published in the vendor bulletin
- Downstream Android OEM builds incorporating the vulnerable code paths
Discovery Timeline
- 2026-09-08 - CVE-2026-28590 published to the National Vulnerability Database (NVD)
- 2026-09-10 - CVE-2026-28590 last modified in the NVD database
Technical Details for CVE-2026-28590
Vulnerability Analysis
The flaw resides in Android platform code that validates encryption keys before they are used in security-sensitive operations. According to the vendor advisory, a logic error causes the validation routine to accept keys that should be rejected. When the check is bypassed, cryptographic guarantees that normally isolate privileged operations from unprivileged callers no longer hold. An attacker executing code on the device can leverage this to perform actions restricted to higher-privileged contexts. The classification under [CWE-347] indicates the failure sits in signature or key verification logic rather than in encryption primitives themselves. Full technical specifics are documented in the Android Security Bulletin September 2026.
Root Cause
The root cause is a logic error in the encryption key validation code path, present in multiple locations. The validation returns a success state under conditions that should be treated as invalid, allowing attacker-controlled or unauthorized keys to pass verification.
Attack Vector
Exploitation requires local access with low privileges, such as a malicious or compromised application already installed on the device. No user interaction is required. Successful exploitation results in local escalation of privilege, granting the attacker capabilities beyond those originally sanctioned for the process.
No public exploit code or proof-of-concept has been published at the time of writing. Refer to the vendor bulletin for authoritative technical details.
Detection Methods for CVE-2026-28590
Indicators of Compromise
- Applications requesting or handling encryption keys outside their documented behavior
- Unexpected privilege transitions on devices, such as processes gaining access to protected system resources
- Anomalous access to keystore or cryptographic service APIs from non-system applications
Detection Strategies
- Monitor mobile device management (MDM) telemetry for devices running Android builds that predate the September 2026 patch level.
- Inspect application behavior for use of low-level cryptographic interfaces inconsistent with the app's stated function.
- Correlate crash logs and SELinux denials that reference key validation or keystore components.
Monitoring Recommendations
- Track the Android security patch level reported by managed devices and flag any device missing the September 2026 update.
- Use mobile threat defense tooling to alert on applications performing privilege-sensitive cryptographic operations.
- Ingest device attestation results into a central data lake to identify devices whose integrity state has changed.
How to Mitigate CVE-2026-28590
Immediate Actions Required
- Apply the September 2026 Android security patch to all managed devices as soon as the OEM release is available.
- Enforce a minimum security patch level through mobile device management policies and block non-compliant devices from sensitive resources.
- Audit installed applications and remove any that are untrusted or unnecessary, reducing the pool of potential local attackers.
Patch Information
Google addresses CVE-2026-28590 in the September 2026 Android Security Bulletin. Device manufacturers deliver the fix through their own firmware updates aligned to the 2026-09-01 or later security patch level. Confirm the patch has been applied by checking the Android security patch level in device settings or MDM inventory. See the Android Security Bulletin September 2026 for authoritative fix details.
Workarounds
- No vendor-published workaround is available. The Android Security Bulletin lists patching as the remediation.
- Restrict installation of applications to vetted sources such as Google Play with Play Protect enabled.
- Require device attestation before granting access to enterprise applications and data.
# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
