Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-28641

Google Android: privilege escalation

Risk score
47/100
CVSS
7.8 v3.1
Exploit chance (30 days)
0.1%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
Google Android
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Google AndroidTHE FLAWSTHE FIXCVE-2026-28641Privilege escalationCVSS 7.8 · EPSS 0%CVE-2026-58835Heap buffer overflow can leadto remote code executionCVSS 8.8 · EPSS 0%CVE-2026-55280In multiple locations, there is apossible out-of-bounds writedue to uninitialized dataCVSS 8.8 · EPSS 0%CVE-2026-45524Missing authorisationCVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedGoogle AndroidYELLOW · PLAN IT INGoogle AndroidIn cfg2prop of btif_storage.cc,there is a possibleout-of-bounds write due to aheap buffer overflow. This couldlead to remote code executionwith no additional executionprivileges needed. User…Where it standsNo known exploitationCONNECTS TOSame weaknessPrivilege escalation (CWE-269)156 other warnings in 30 days →Same productEarlier Google Android warnings23 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Google Android: Yellow, plan it in. In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

The flaws

  • CVE-2026-28641: Privilege escalation (CVSS 7.8 · EPSS 0%)
  • CVE-2026-58835: Heap buffer overflow can lead to remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-55280: In multiple locations, there is a possible out-of-bounds write due to uninitialized data (CVSS 8.8 · EPSS 0%)
  • CVE-2026-45524: Missing authorisation (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Google Android

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.8 high

References

Original description

In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Last activity 5 Oct 2026. Patch Forecast updates every hour.