CVE-2026-28671 Overview
CVE-2026-28671 is a race condition vulnerability in the updateInternal function of MediaProvider.java on Android. The flaw allows a local application to expose the contents of files that would otherwise be protected. Exploitation requires no user interaction and no additional execution privileges beyond those already granted to the attacking app. The issue results in local information disclosure and is tracked under [CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition].
Critical Impact
A local attacker with low privileges can read the contents of files handled by MediaProvider without user interaction, breaking the confidentiality boundary between apps.
Affected Products
- Android Open Source Project (AOSP) MediaProvider component
- Android devices receiving the September 2026 security patch level
- Google Pixel and OEM Android builds referencing the September 2026 bulletin
Discovery Timeline
- 2026-09-08 - CVE-2026-28671 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28671
Vulnerability Analysis
The vulnerability lives in the updateInternal method of MediaProvider.java, the AOSP content provider that mediates access to shared media storage. A race condition between permission or path validation and the file operation itself allows a concurrent actor to change the underlying state after the check has succeeded. The result is that a caller can be granted access to file contents it should not be able to read.
Because MediaProvider brokers access across app boundaries, a successful race lets the attacking app obtain data owned by other apps or by the media store itself. The attack executes locally on the device with no user interaction and no elevated privileges.
Root Cause
The root cause is a Time-of-Check Time-of-Use (TOCTOU) flaw [CWE-367] inside updateInternal. The function validates a condition, such as ownership, path, or permission, and then acts on the resource in a separate, non-atomic step. Between the check and the use, another thread or process can alter the target, causing MediaProvider to operate on a resource the caller should not access.
Attack Vector
Exploitation is local. A malicious application installed on the device issues concurrent update requests through the MediaProvider content resolver while simultaneously mutating the target file or its metadata. Winning the race causes MediaProvider to expose file contents to the calling app. No user prompt, gesture, or additional permission grant is required beyond what a normal app can request.
No public proof-of-concept exploit is listed for this CVE. See the Android Security Bulletin September 2026 for the official technical reference.
Detection Methods for CVE-2026-28671
Indicators of Compromise
- Applications issuing high-frequency ContentResolver.update calls against MediaStore URIs in tight loops.
- Unexpected read access patterns from third-party apps against media files owned by other packages.
- Apps repeatedly renaming, symlinking, or replacing files under shared media directories during MediaProvider operations.
Detection Strategies
- Monitor Android device patch levels and flag endpoints not on the September 2026 or later security patch level.
- Review installed applications for those requesting broad media storage access combined with suspicious runtime behavior.
- Use mobile threat defense telemetry to identify apps performing rapid, concurrent MediaProvider operations consistent with race-condition exploitation.
Monitoring Recommendations
- Track Android security patch level compliance across the managed mobile fleet.
- Alert on newly sideloaded APKs on devices that have not yet received the September 2026 patch.
- Correlate MDM inventory data with the Android Security Bulletin to prioritize devices missing the fix.
How to Mitigate CVE-2026-28671
Immediate Actions Required
- Apply the Android security patch level dated 2026-09-01 or later to all managed devices.
- Identify devices that cannot receive the update and restrict them from handling sensitive media or corporate data.
- Audit installed applications and remove untrusted apps that request storage or media access.
Patch Information
Google addressed CVE-2026-28671 in the Android Security Bulletin September 2026. Device manufacturers integrate the AOSP fix into their monthly OEM updates. Confirm the patch is present by checking that the device reports an Android security patch level of 2026-09-01 or later under Settings.
Workarounds
- Restrict installation of third-party apps through mobile device management (MDM) policies until patches are deployed.
- Limit corporate data access from Android devices below the September 2026 patch level using conditional access.
- Educate users to avoid installing apps from unknown sources that request media or storage permissions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
