CVE-2026-28604: Use After Free Race Condition Vulnerability

CVE-2026-28604 Overview

CVE-2026-28604 is a use-after-free vulnerability caused by a race condition affecting multiple locations in Android. The flaw allows remote code execution without requiring additional execution privileges or user interaction. Google disclosed the issue in the Android Security Bulletin for September 2026. The vulnerability is tracked under CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization.

Critical Impact
An attacker can win a race condition to trigger use-after-free memory corruption and achieve remote code execution on affected Android devices without user interaction.

Affected Products

Android (multiple components, per the September 2026 Android Security Bulletin)

Discovery Timeline

2026-09-08 - CVE-2026-28604 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28604

Vulnerability Analysis

The vulnerability exists in multiple locations within Android where concurrent execution paths access shared memory objects without adequate synchronization. When two threads operate on the same resource, one thread can free an object while another thread retains and dereferences a stale pointer. Dereferencing freed memory produces undefined behavior that an attacker can shape into arbitrary code execution.

Exploitation requires no user interaction and no additional execution privileges beyond those already available to a low-privilege caller. The attack surface is network-reachable, meaning a remote adversary can deliver the trigger without local access to the device. Successful exploitation impacts confidentiality, integrity, and availability of the affected process.

Root Cause

The root cause is improper synchronization between concurrent execution contexts, categorized as CWE-362. Shared objects lack the locking or reference-counting discipline required to prevent one thread from freeing memory that another thread still holds. The window between the free operation and the stale dereference is the race window that an attacker must win.

Attack Vector

The attack vector is network-based. An attacker sends crafted input that induces concurrent code paths to operate on the same object. By repeatedly triggering the race, the attacker forces a use-after-free condition and manipulates the freed allocation to control execution flow. Because user interaction is not required, exploitation can be automated against reachable devices.

Specific technical details for the affected components are documented in the Android Security Bulletin September 2026. No public proof-of-concept exploit code has been observed at the time of publication.

Detection Methods for CVE-2026-28604

Indicators of Compromise

Unexpected crashes or tombstone files in /data/tombstones/ referencing SIGSEGV faults in the affected components, particularly with fault addresses resembling freed heap patterns.
Anomalous inbound network traffic patterns generating repeated, rapid requests to a single service endpoint on Android devices, consistent with race-window grooming.

Detection Strategies

Monitor Android device telemetry for repeated process crashes in system services, especially crashes correlated with inbound network activity.
Correlate logcat and kernel logs for use-after-free signatures such as KASAN reports on debug builds, or unexplained native crashes on production builds.
Deploy network intrusion detection rules that flag high-frequency, low-volume request bursts targeting Android network-facing services.

Monitoring Recommendations

Track Android patch level compliance across the managed device fleet and alert on devices running builds prior to the September 2026 security patch level.
Ingest mobile device management (MDM) crash and health telemetry into a centralized log platform for correlation with network events.
Alert on unmanaged Android devices connecting to enterprise networks that cannot be verified against the September 2026 patch baseline.

How to Mitigate CVE-2026-28604

Immediate Actions Required

Apply the Android security patch level 2026-09-01 or later to all managed Android devices as soon as the OEM makes it available.
Inventory devices that cannot receive the September 2026 patch and restrict their access to sensitive enterprise resources.
Enforce MDM policies requiring minimum patch levels for corporate network and application access.

Patch Information

Google addressed CVE-2026-28604 in the September 2026 Android Security Bulletin. Devices with a security patch level of 2026-09-01 or later contain the fix. Refer to the Android Security Bulletin September 2026 for the complete list of affected components and OEM guidance. Device manufacturers typically release corresponding firmware updates on a staggered schedule.

Workarounds

No vendor-published workaround exists; patching remains the only complete mitigation.
Reduce network exposure of Android devices by segmenting them from untrusted networks and blocking unsolicited inbound traffic where feasible.
Disable or restrict use of network-facing services on unpatched devices until the vendor update is applied.

bash

# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch

# Expected output for patched devices:
# 2026-09-01 (or later)