# CVE-2026-28659: MicroXR Blobstore privilege escalation via missing permission check

Source: https://junglewise.ai/threats/cve-2026-28659-microxr-blobstore-privilege-escalation-via-missing-permission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-28659 · Severity: high · CVSS 7.8 · Published 2026-09-08

MicroXR Blobstore is a file storage component in the Android XR platform. A missing permission check allows any local application to access files belonging to other applications, potentially leading to theft of sensitive data or exposure of credentials. This escalation requires no special privileges or user interaction to exploit.

Technologies: [Google Android XR](https://junglewise.ai/threats/technologies/android-xr). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-28659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28659 being exploited in the wild.

**How severe is CVE-2026-28659?** High severity, with a CVSS score of 7.8, published 8 September 2026.

**Which products and versions are affected?** Google Android XR 14.

**Is there a fix for CVE-2026-28659?** A patch was published on 2026-09-01: Fix included in security patch level 2026-09-01 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28659 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-28659?** Check whether you run Google Android XR or Google MicroXR Blobstore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a local privilege escalation (EoP) in MicroXR Blobstore caused by inadequate permission validation when accessing stored files. The flaw allows an unprivileged local application to bypass access controls and read or manipulate files belonging to other applications without authorization. Attack surface is limited to local network access (adjacent or local) and requires no additional execution privileges; user interaction is not needed. An attacker can achieve unauthorized access to cross-app data, compromising confidentiality and integrity. The Android XR Security Bulletin for September 2026 indicates patches are available in security patch level 2026-09-01 or later; affected AOSP versions include Android 14.

## Affected products

- Google Android XR 14
- Google MicroXR Blobstore

## Timeline

- 2026-09-08: disclosed: CVE-2026-28659 published in Android XR Security Bulletin
- 2026-09-01: patched: Fix included in security patch level 2026-09-01 or later

## References

- [https://source.android.com/docs/security/bulletin/xr/2026/2026-09-01](https://source.android.com/docs/security/bulletin/xr/2026/2026-09-01)

## Related threats

- [Android XR Framework permission bypass in WindowManagerService](https://junglewise.ai/threats/cve-2026-58873-in-adddragdroplistener-of-windowmanagerservice-java-there-is-a)
- [Google Android InputMethodManagerService privilege escalation](https://junglewise.ai/threats/cve-2026-0072-google-android-inputmethodmanagerservice-privilege-escalation)