CVE-2026-28652: RangingServiceImpl MITM Information Leak

CVE-2026-28652 is a man-in-the-middle information disclosure flaw in RangingServiceImpl.java caused by missing permission checks. Attackers can remotely access sensitive data without privileges or user interaction. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-28652 Overview

CVE-2026-28652 is an information disclosure vulnerability in the Android RangingServiceImpl.java component. The flaw stems from a missing permission check across multiple functions in the ranging service. An attacker positioned on the network can perform a man-in-the-middle (MITM) attack to disclose sensitive information from the device.

Exploitation requires no user interaction and no additional execution privileges beyond low-level authenticated access. The issue is tracked under CWE-862: Missing Authorization and was disclosed in the Android Security Bulletin September 2026.

Critical Impact
Remote information disclosure via MITM without user interaction, affecting devices that expose the Android ranging service to network-adjacent attackers.

Affected Products

Android platform (versions per Android Security Bulletin September 2026)
Devices implementing RangingServiceImpl.java in the Android framework
OEM builds shipping the affected ranging service component

Discovery Timeline

2026-09-08 - CVE-2026-28652 published to the National Vulnerability Database (NVD)
2026-09-01 - Android Security Bulletin publication addressing the issue
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28652

Vulnerability Analysis

The vulnerability resides in RangingServiceImpl.java, a component of the Android framework responsible for handling ranging operations between devices. Multiple functions within this class fail to enforce required permission checks before processing ranging requests or returning results.

Because the service does not verify caller authorization, a network-positioned attacker can interpose in ranging exchanges. The attacker can intercept or observe data that should be restricted to permitted callers. The exposure is limited to confidentiality only; integrity and availability remain unaffected according to the published CVSS vector.

Exploitation is rated with high attack complexity, reflecting the network positioning and timing required to intercept ranging traffic. The absence of user interaction requirements means targeted users receive no prompt or indication during exploitation.

Root Cause

The root cause is a missing authorization check [CWE-862] across multiple entry points of RangingServiceImpl.java. Android services must invoke permission enforcement, typically through enforceCallingPermission() or similar framework APIs, before returning sensitive data to callers. The affected functions bypass this control, allowing unauthorized access to ranging data.

Attack Vector

An attacker on the same network path as the target device performs a MITM interception of ranging exchanges. Because the service accepts requests without validating caller permissions, the attacker can observe ranging metadata and derived positional or identifier information. No credentials from the victim device are required, and no user consent dialog is triggered.

No public proof-of-concept code is available for CVE-2026-28652. Refer to the Android Security Bulletin September 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-28652

Indicators of Compromise

Unexpected ranging service traffic originating from or destined to unknown network peers on managed mobile devices
Anomalous invocations of RangingServiceImpl methods in device logs prior to patching
Mobile devices operating on untrusted Wi-Fi where ranging protocols are active

Detection Strategies

Inventory Android devices and identify builds that predate the September 2026 security patch level
Correlate mobile device network telemetry to flag MITM indicators such as unexpected gateway changes or ARP anomalies on wireless segments
Review mobile device management (MDM) compliance reports for devices missing the September 2026 Android patch level

Monitoring Recommendations

Ingest MDM patch-level reporting into your SIEM to track exposure over time
Monitor enterprise Wi-Fi infrastructure for rogue access points and MITM signatures
Alert on mobile devices connecting to networks outside sanctioned corporate segments while unpatched

How to Mitigate CVE-2026-28652

Immediate Actions Required

Apply the Android September 2026 security patch level or later to all managed devices
Enforce MDM policies that block enrollment or corporate resource access for devices below the required patch level
Restrict use of untrusted wireless networks on devices that cannot be updated immediately

Patch Information

Google addressed CVE-2026-28652 in the Android Security Bulletin September 2026. Device manufacturers integrate the fix into OEM security patch levels dated 2026-09-01 or later. Verify patch delivery through your device vendor, as timing varies across OEMs and carriers.

Workarounds

Disable or restrict features that invoke the ranging service where operationally feasible
Require VPN usage on mobile devices to reduce exposure to network-adjacent MITM attackers
Segment corporate wireless networks and enforce WPA3 with management frame protection to reduce MITM opportunities

bash

# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediation: 2026-09-01 or later