CVE-2026-28658: Android AccountsDb Privilege Escalation Flaw

CVE-2026-28658 Overview

CVE-2026-28658 is a local privilege escalation vulnerability in the Android AccountsDb.java component. The flaw resides in the findMetaAuthUid method and stems from a logic error that enables a Factory Reset Protection (FRP) bypass. An attacker with local access can escalate privileges without requiring user interaction or additional execution privileges. The vulnerability is classified under [CWE-693] Protection Mechanism Failure and was addressed in the Android Security Bulletin for September 2026.

Critical Impact

Local attackers can bypass Factory Reset Protection and escalate privileges on affected Android devices without user interaction.

Affected Products

• Android Open Source Project (AOSP)
• Devices running affected Android versions per the September 2026 Android Security Bulletin
• The AccountsDb component within the Android accounts subsystem

Discovery Timeline

• 2026-09-08 - CVE-2026-28658 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28658

Vulnerability Analysis

The vulnerability exists in the findMetaAuthUid method of AccountsDb.java, part of the Android account management framework. AccountsDb handles persistent storage of account metadata, including authenticator user IDs (UIDs) used to enforce access boundaries between accounts and their owning applications. A logic error in the method causes the FRP protection mechanism to be bypassed under specific conditions.

Factory Reset Protection is designed to prevent unauthorized use of a device after a factory reset by requiring the previously configured Google account credentials. When findMetaAuthUid returns incorrect authenticator UID data, the FRP check that gates post-reset setup can be circumvented, granting the attacker elevated capabilities on the device.

Root Cause

The root cause is a logic error [CWE-693] in the account authenticator UID lookup routine. The method fails to correctly validate or match authenticator metadata, allowing account state to be interpreted in a way that circumvents FRP enforcement. Because the flaw sits in a protection mechanism rather than a memory safety boundary, exploitation does not require corrupting memory or bypassing signature checks.

Attack Vector

Exploitation requires local access to the device. An attacker with physical possession of a reset device can trigger the flawed code path during device setup to bypass the FRP challenge. No user interaction is required, and no additional privileges beyond local access are needed. Successful exploitation results in local privilege escalation and effective ownership of the device without the legitimate account credentials.

No public proof-of-concept exploit code is available. The vulnerability is described in prose within the Android Security Bulletin September 2026.

Detection Methods for CVE-2026-28658

Indicators of Compromise

• Devices that complete setup after a factory reset without presenting the expected Google account challenge
• Unexpected account entries appearing in the accounts.db SQLite database during initial device provisioning
• Setup Wizard sessions that transition to the home screen without validating a previously bound account

Detection Strategies

• Monitor enterprise mobility management (EMM) telemetry for enrolled devices whose ownership or associated Google account changes without an authorized re-provisioning workflow
• Inspect logcat output from the AccountManagerService and Settings packages for anomalous authenticator UID lookups during setup
• Audit device attestation results for inconsistencies between hardware-backed identity and the currently bound Google account

Monitoring Recommendations

• Track device patch level via mobile device management (MDM) to confirm the September 2026 Android security patch level is applied
• Alert on lost or stolen devices that reappear online with a different primary account
• Correlate account provisioning events with physical custody records for corporate-issued devices

How to Mitigate CVE-2026-28658

Immediate Actions Required

• Apply the September 2026 Android security patch level to all managed devices as soon as vendor builds are available
• Enforce MDM policies that block enrollment of devices below the required patch level
• Physically secure devices pending patch rollout, since exploitation requires local access

Patch Information

Google addressed the vulnerability in the Android Security Bulletin September 2026. Device manufacturers integrate the fix into their September 2026 or later security patch level (SPL) releases. Confirm the SPL under Settings > About phone > Android security update on each device.

Workarounds

• No vendor-supplied workaround exists; applying the patch is the only supported remediation
• Restrict physical access to devices that cannot be updated immediately
• For high-risk deployments, disable local account provisioning workflows and require server-side zero-touch enrollment