Live › vulnerability › CVE-2026-28588
Google's November 2026 Android bulletin lists CVE-2026-28588 as a High-severity elevation-of-privilege flaw in the Framework (ExternalStorageProvider), fixed in patch level 2026-11-05. The bulletin gives no exploitation details and does not say it is exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Android 14, 15, 16, 16-QPR2 and 17 devices without the 2026-11-05 security patch level are affected. The bulletin lists it as local elevation of privilege, so a malicious app on the device is needed. Devices already at 2026-11-05 or later can skip it; the timing of vendor updates varies by phone maker.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Android | vendor | 14, 15, 16, 16-qpr2, 17 before patch level 2026-11-05 | security patch level 2026-11-05 |
Update to Android security patch level 2026-11-05 or later (Framework fix, bug A-475232460)
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-28588")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.