CVE-2026-28620: URI Access Privilege Escalation Vulnerability

CVE-2026-28620 is a privilege escalation vulnerability affecting multiple system locations through unauthorized URI access due to permissions bypass. Attackers can exploit this locally without user interaction or additional privileges. This article covers technical details, impact analysis, and recommended mitigation strategies.

CVE-2026-28620 Overview

CVE-2026-28620 is a permissions bypass vulnerability affecting Android that allows unauthorized Uniform Resource Identifier (URI) access across multiple locations in the platform. An attacker with local access can exploit this flaw to escalate privileges without additional execution rights. Exploitation requires no user interaction, which reduces the barrier for successful attacks on affected devices. The issue is tracked under CWE-863: Incorrect Authorization and was disclosed in the Android Security Bulletin September 2026.

Critical Impact
Local attackers can bypass URI access permissions to achieve privilege escalation, gaining high impact on confidentiality, integrity, and availability of the affected Android device.

Affected Products

Android platform components referenced in the September 2026 Android Security Bulletin
Devices running unpatched Android builds prior to the September 2026 security patch level
Original Equipment Manufacturer (OEM) Android distributions inheriting the vulnerable components

Discovery Timeline

2026-09-08 - CVE-2026-28620 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-28620

Vulnerability Analysis

The vulnerability is an authorization bypass affecting URI handling in multiple locations within the Android platform. A local application can request URI access that should be restricted by the platform permission model. Because the authorization check is either missing or incorrectly enforced, the request succeeds and grants access to protected resources. The result is local privilege escalation without requiring additional execution privileges or user interaction. The National Vulnerability Database maps the flaw to CWE-863: Incorrect Authorization.

Root Cause

The root cause is inconsistent enforcement of URI permission checks across multiple code paths. Where one code path validates caller identity and grant scope, another path performs the same operation without equivalent validation. An attacker targets the weaker path to obtain the same data or capability without holding the required permission grant.

Attack Vector

Exploitation requires a locally installed application on the target device. The malicious application invokes the vulnerable code path with a crafted URI reference to a protected resource. Because no user interaction is required and no elevated privileges are needed to launch the request, the attack can execute silently in the background. Successful exploitation yields access to data or functionality reserved for higher-privileged components. Refer to the Android Security Bulletin September 2026 for component-level details.

Detection Methods for CVE-2026-28620

Indicators of Compromise

Unexpected application access to content providers or system URIs outside the app's declared permissions
Log entries showing grantUriPermission or checkUriPermission calls from apps that should not hold those grants
Newly installed applications requesting or accessing sensitive content URIs shortly after installation

Detection Strategies

Compare installed application permission manifests against runtime URI access patterns captured in logcat and audit logs
Monitor Android Enterprise device attestation and patch-level reports for devices below the September 2026 security patch level
Use mobile threat defense telemetry to flag applications performing anomalous ContentResolver queries against protected authorities

Monitoring Recommendations

Ingest mobile device management (MDM) compliance events into a Security Information and Event Management (SIEM) platform to track patch adoption
Alert on new applications sideloaded from non-Play sources on devices without the September 2026 patch
Correlate mobile endpoint telemetry with identity signals to detect subsequent lateral movement after local escalation

How to Mitigate CVE-2026-28620

Immediate Actions Required

Apply the September 2026 Android security patch level or later to all managed devices
Enforce MDM policies that block enrollment or access from devices below the required patch level
Restrict sideloading and audit third-party application sources across the mobile fleet

Patch Information

Google addressed CVE-2026-28620 in the September 2026 Android security patch. Device manufacturers ship the fix through their OEM update channels once they integrate the upstream Android Open Source Project (AOSP) changes. Confirm remediation by verifying the device's security patch level is 2026-09-01 or later in Settings. Full component details are available in the Android Security Bulletin September 2026.

Workarounds

Limit installation of untrusted applications on devices pending an OEM patch
Segment sensitive corporate data using work profile separation to reduce exposure from a compromised personal app
Retire or replace devices that no longer receive vendor security updates covering the September 2026 bulletin

bash

# Verify Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-09-01 or later