CVE-2026-28638 Overview
CVE-2026-28638 is an information disclosure vulnerability in XmpDataParser.java, a component used to parse Extensible Metadata Platform (XMP) data on Android. A logic error in multiple functions causes improper data sanitization when handling parsed metadata. A local attacker with low privileges can leverage the flaw to read information they should not have access to. No user interaction is required for exploitation. The issue was disclosed as part of the Android Security Bulletin for September 2026 and is classified under [CWE-20: Improper Input Validation].
Critical Impact
Local information disclosure without additional execution privileges and without user interaction, enabling low-privileged applications on an Android device to read data outside their intended access boundary.
Affected Products
- Android platform components referenced in the Android Security Bulletin September 2026
- XmpDataParser.java metadata parsing logic
- Applications and system services that rely on the affected parser for XMP handling
Discovery Timeline
- 2026-09-08 - CVE-2026-28638 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28638
Vulnerability Analysis
The defect resides in multiple functions of XmpDataParser.java, the Android component responsible for parsing XMP metadata embedded in media files. A logic error causes the parser to skip or misapply sanitization checks on parsed fields. As a result, data that should be filtered, redacted, or scoped to a privileged context can flow back to the calling application. The vulnerability is categorized as [CWE-20: Improper Input Validation] and manifests as local information disclosure. Exploitation does not grant code execution, elevated privileges, or the ability to modify data, and its impact is confined to confidentiality on the local device.
Root Cause
The root cause is a logic error in the sanitization path of the XMP parser. The affected functions do not consistently enforce the checks required to strip or normalize untrusted metadata content before returning it to callers. Because sanitization is inconsistent across code paths, specific inputs bypass the intended filtering and expose data to the caller.
Attack Vector
The attack vector is local. An attacker must already have code running on the device, typically through a co-resident low-privileged application. The malicious application supplies crafted XMP metadata to the affected parser and reads back information disclosed through the sanitization gap. User interaction is not required. Because integrity and availability are not affected, the vulnerability is useful primarily as a building block for broader reconnaissance or as a stepping stone in a multi-stage attack chain. Refer to the Android Security Bulletin September 2026 for component-level technical details.
Detection Methods for CVE-2026-28638
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2026-28638 at the time of writing.
- No known exploitation in the wild has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Strategies
- Inventory Android devices and confirm which builds include the September 2026 security patch level using mobile device management (MDM) reporting.
- Monitor installed applications for permissions and behaviors consistent with abusive metadata parsing, such as bulk access to media files by non-media applications.
- Review application telemetry for repeated invocation of XMP parsing APIs from unexpected callers.
Monitoring Recommendations
- Track Android Security Bulletin patch level compliance across the managed fleet on a recurring cadence.
- Alert on installations of sideloaded applications that request access to media stores without a clear business justification.
- Correlate mobile threat defense telemetry with application inventory to identify devices that remain unpatched after the September 2026 bulletin.
How to Mitigate CVE-2026-28638
Immediate Actions Required
- Apply the Android security patch level dated 2026-09-01 or later on all managed devices as soon as the vendor build is available.
- Enforce a minimum patch level policy through MDM to block or restrict devices that have not received the September 2026 update.
- Restrict installation of untrusted third-party applications that could act as the local attacker required for exploitation.
Patch Information
The fix is delivered through the Android monthly update process. Consult the Android Security Bulletin September 2026 for the mapping of CVE-2026-28638 to specific source projects and patch commits. Device manufacturers ship the corresponding update to end users through their standard over-the-air (OTA) channels.
Workarounds
- No vendor-provided workaround has been published; patching to the September 2026 security patch level is the supported remediation.
- Reduce local attack surface by limiting the number of installed applications and disallowing sideloading on enterprise-managed devices.
- Where patching is delayed, avoid processing untrusted media containing XMP metadata on affected devices.
# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
