CVE-2026-28622 Overview
CVE-2026-28622 is a local information disclosure vulnerability in the Android MediaProvider component. The flaw resides in the getQueryBuilderInternal method of MediaProvider.java, where a permissions check can be bypassed. An attacker with local access and low privileges can retrieve location metadata embedded in media files without holding the required permission. The vulnerability requires no user interaction and no additional execution privileges. It is categorized under CWE-862: Missing Authorization.
Critical Impact
Local applications can read geolocation metadata from media files, exposing user location history without triggering permission prompts.
Affected Products
- Android Open Source Project (AOSP) MediaProvider component
- Android devices receiving the September 2026 security patch level
- Refer to the Android Security Bulletin September 2026 for the full list of affected builds
Discovery Timeline
- 2026-09-08 - CVE-2026-28622 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28622
Vulnerability Analysis
The MediaProvider component brokers access to media files (images, video, audio) stored on Android devices. Applications query it through content URIs to retrieve media and associated metadata. Location metadata, such as EXIF GPS coordinates embedded in photos, is gated behind the ACCESS_MEDIA_LOCATION permission.
The flaw exists in getQueryBuilderInternal, the method responsible for constructing the SQL query builder that scopes results based on caller identity and granted permissions. A logic error in this path allows a caller without ACCESS_MEDIA_LOCATION to retrieve columns or rows that expose location fields. The result is a permissions bypass that reveals sensitive geolocation data through legitimate content-resolver calls.
Root Cause
The root cause is missing authorization [CWE-862]. getQueryBuilderInternal does not correctly enforce the location-permission gate for every query path. Callers that would normally have location data redacted receive unredacted metadata instead.
Attack Vector
Exploitation requires a locally installed application with basic content-provider access. The malicious application issues a crafted query against MediaStore URIs to trigger the vulnerable code path. No user interaction is required. The attacker gains read access to location metadata but cannot modify data or affect availability. See the Android Security Bulletin September 2026 for AOSP commit references and code-level details.
Detection Methods for CVE-2026-28622
Indicators of Compromise
- Applications querying MediaStore content URIs while lacking the ACCESS_MEDIA_LOCATION permission in their manifest
- Unusual read patterns against MediaProvider from third-party applications that have no legitimate need for media metadata
- Installed applications requesting only READ_MEDIA_IMAGES or READ_EXTERNAL_STORAGE but exfiltrating GPS coordinates
Detection Strategies
- Audit installed applications for content-resolver calls targeting MediaStore.Images.Media.EXTERNAL_CONTENT_URI with projections that include LATITUDE or LONGITUDE columns
- Use Android runtime logs (logcat) to identify MediaProvider queries originating from packages without ACCESS_MEDIA_LOCATION
- Review Google Play Protect and mobile threat defense telemetry for applications flagged as accessing location metadata without appropriate permissions
Monitoring Recommendations
- Enable enterprise mobility management (EMM) policies that report on installed application permissions and content-provider usage
- Monitor for outbound network transfers of GPS coordinate data from managed devices
- Track Android security patch levels across the device fleet and flag devices not on the September 2026 patch level or later
How to Mitigate CVE-2026-28622
Immediate Actions Required
- Apply the September 2026 Android security patch level (2026-09-01 or later) as soon as the OEM makes it available for the device model
- Inventory managed Android devices and identify those running builds prior to the September 2026 patch level
- Restrict installation of untrusted third-party applications through EMM policy until patches are deployed
Patch Information
Google addressed the issue in the September 2026 Android Security Bulletin. Device manufacturers integrate the AOSP fix into their monthly security updates. Refer to the Android Security Bulletin September 2026 for the specific AOSP patch commits and affected Android versions.
Workarounds
- Limit application installation to vetted sources such as Google Play and enterprise app catalogs
- Strip location metadata from sensitive media before storing it on device using the built-in Android sharing controls
- Enforce EMM policies that deny installation of applications requesting media permissions without business justification
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
