CVE-2026-28659: MicroXR Blobstore Privilege Escalation

CVE-2026-28659 Overview

CVE-2026-28659 is a privilege escalation vulnerability in MicroXR Blobstore, a component of the Android XR platform. The flaw stems from a missing permission check that allows an application to access files belonging to other applications. Exploitation requires no user interaction and no additional execution privileges. The issue is tracked under [CWE-269: Improper Privilege Management] and was disclosed in the Android XR Security Bulletin for September 2026.

Critical Impact
A local application can bypass Android's app sandbox to read or manipulate files owned by other applications, resulting in local privilege escalation without user interaction.

Affected Products

Android XR platform (MicroXR Blobstore component)
Devices covered by the Android XR Security Bulletin dated 2026-09-01
Downstream OEM builds incorporating the vulnerable Blobstore component

Discovery Timeline

2026-09-08 - CVE-2026-28659 published to NVD
2026-09-09 - Last updated in NVD database
2026-09-01 - Referenced in the Android XR Security Bulletin September 2026

Technical Details for CVE-2026-28659

Vulnerability Analysis

MicroXR Blobstore provides shared blob storage services to applications running on Android XR. The component is expected to enforce per-application access controls so that one app cannot read files staged by another. The vulnerability arises because a required permission check is absent along an accessible code path. A local application can therefore request or reference blobs registered by other apps and obtain their file contents.

The result is a sandbox escape at the file-access layer. Because the missing check is unconditional, the attacker does not need elevated privileges or user consent. The impact category is local privilege escalation, since the calling app gains rights it was never granted by the platform or by the target app.

Root Cause

The root cause is a missing authorization check ([CWE-269]) in the Blobstore access path. The component fails to validate whether the calling UID is authorized to access the requested blob before returning a file handle or data. Any code path that should have gated cross-app file access on a permission, signature match, or ownership check instead proceeds unconditionally.

Attack Vector

Exploitation is local. A malicious application installed on an affected Android XR device issues Blobstore requests referencing files owned by another application. Because the permission check is missing, the service returns access to the target files. No user prompt, no runtime permission grant, and no additional exploit primitive is required. The attacker can enumerate and exfiltrate app-private data, including credentials, tokens, and cached content, then use that data to escalate further within the device.

No public proof-of-concept code is available. Refer to the Android XR Security Bulletin September 2026 for vendor technical details.

Detection Methods for CVE-2026-28659

Indicators of Compromise

Unexpected read access to files under other applications' private data directories originating from a non-system UID.
Blobstore service calls from applications that have no legitimate reason to interact with cross-app blob storage.
Newly installed applications that immediately query Blobstore for blobs they did not create.

Detection Strategies

Audit Blobstore service logs for cross-UID access patterns where the caller UID differs from the blob owner UID.
Baseline expected Blobstore consumers per device profile and alert on deviations, particularly high-frequency lookups from single UIDs.
Correlate application installation events with subsequent bulk file access from the same package to identify staged exploitation.

Monitoring Recommendations

Ingest Android XR device telemetry into a centralized analytics pipeline and retain Blobstore and package manager events.
Track patch level compliance and flag devices that have not applied the 2026-09-01 or later Android XR security patch level.
Monitor mobile device management (MDM) posture for XR endpoints and enforce policy on unpatched devices.

How to Mitigate CVE-2026-28659

Immediate Actions Required

Apply the Android XR security patch level 2026-09-01 or later on all affected devices.
Inventory Android XR devices in the fleet and prioritize patch rollout for devices that install third-party applications.
Restrict sideloading and enforce installation only from vetted sources until patches are applied.

Patch Information

The fix is delivered through the Android XR Security Bulletin dated 2026-09-01. Device vendors and OEMs distribute the corresponding patch through system updates. Administrators should confirm the reported patch level on each device matches or exceeds 2026-09-01. See the Android XR Security Bulletin September 2026 for the authoritative patch reference.

Workarounds

Prevent installation of untrusted applications through MDM policy while patches are pending.
Limit devices to a curated allowlist of applications to reduce the local attack surface.
Isolate unpatched Android XR devices from networks and accounts holding sensitive credentials.

bash

# Verify Android XR security patch level on a connected device
adb shell getprop ro.build.version.security_patch

# Expected output should be 2026-09-01 or later