Executive brief
Android devices contain a logic error in encryption key validation across multiple system components. This flaw allows a malicious app or local attacker to escalate privileges and gain elevated access to the device without requiring user interaction or additional system permissions, potentially compromising sensitive data and device functionality.
Technical details
CVE-2026-28590 is a logic error in encryption key validation code affecting multiple locations within Android's system components. The vulnerability exists in the handling of cryptographic keys where improper validation allows an attacker with local code execution to bypass security checks and escalate privileges. No additional execution privileges or user interaction are required for exploitation. The flaw was patched in Android security patch level 2026-09-05 and later, with fixes released to AOSP for affected versions (14, 15, 16, 16-qpr2, and 17).
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 and later address this issue