{"id":"CVE-2026-28588","kind":"vulnerability","aliases":["CVE-2026-28588"],"related":[],"title":"Android: ExternalStorageProvider logic error exposes protected files to local apps","description":"In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"Google's November 2026 Android bulletin lists CVE-2026-28588 as a High-severity elevation-of-privilege flaw in the Framework (ExternalStorageProvider), fixed in patch level 2026-11-05. The bulletin gives no exploitation details and does not say it is exploited.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Android","fixed":["security patch level 2026-11-05"],"affected":"14, 15, 16, 16-qpr2, 17 before patch level 2026-11-05","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","framework","local-privilege-escalation","runtime"],"not_affected_if":[],"how_to_check":"Settings > About phone > Android version > Android security update; exposed if the patch level is earlier than 2026-11-05 (adb shell getprop ro.build.version.security_patch). Applies to Android 14, 15, 16, 16-QPR2 and 17.","fix":"Update to Android security patch level 2026-11-05 or later (Framework fix, bug A-475232460)","status":"open","published_at":"2026-11-02T20:17:41+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","triaged_at":"2026-11-02T20:36:30+00:00","updated_at":"2026-11-02T20:37:27+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-02T20:36:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: ExternalStorageProvider logic error exposes protected files to local apps","impact":"high","summary":"A logic error in the Android ExternalStorageProvider's shouldBlockDirectoryFromTree check can let a local app access protected data. The sources say it leads to local privilege escalation without extra execution privileges or user interaction.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local app reads protected storage data and escalates privileges","analyst_note":"Check the NVD entry and the Android security bulletin for affected Android versions, the patched patch level, and whether the flaw needs an installed app.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000591,"input_tokens":4119,"output_tokens":359,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Android security bulletin for affected Android versions, the patched patch level, and whether the flaw needs an installed app.","search":"'-05':55B '-11':54B '-2026':12A,15A,33B '-28588':13A,16A,34B '2026':28B,53B 'access':79C 'addit':100C 'android':1A,17A,18B,29B 'app':10A 'bulletin':30B,57B 'code':89C 'could':91C 'cve':11A,14A,32B 'data':81C 'detail':61B 'due':82C 'elev':41B 'elevation-of-privileg':40B 'error':4A,86C 'escal':23B,95C 'execut':101C 'exploit':60B,68B,110C 'expos':5A 'externalstorageprovid':2A,48B 'externalstorageprovider.java':72C 'file':7A 'fix':49B 'flaw':44B 'framework':19B,47B 'give':58B 'googl':25B 'high':38B 'high-sever':37B 'interact':105C 'lead':92C 'level':52B 'list':31B 'local':9A,21B,94C 'local-privilege-escal':20B 'logic':3A,85C 'need':103C,108C 'novemb':27B 'patch':51B 'possibl':76C 'privileg':22B,43B,97C,102C 'protect':6A,80C 'runtim':24B 'say':65B 'sever':39B 'shouldblockdirectoryfromtre':70C 'user':104C 'way':77C","nicknames":[],"mitigations":[],"who_affected":"Android 14, 15, 16, 16-QPR2 and 17 devices without the 2026-11-05 security patch level are affected. The bulletin lists it as local elevation of privilege, so a malicious app on the device is needed. Devices already at 2026-11-05 or later can skip it; the timing of vendor updates varies by phone maker.","tier":"B","verified":{"fix":{"at":"2026-11-02T20:37:27Z","by":"analyst","doc":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","run_id":1419}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Install the latest Android security update: Settings > Security & privacy > System & updates, and make sure your security patch level is November 5, 2026 or later.","pkeys":["android"],"ptokens":["android"],"labels":["android","framework","high","localprivilegeescalation","runtime"],"first_public_at":"2026-11-02T20:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28588","severity":null,"published_at":"2026-11-02T20:17:41+00:00","modified_at":"2026-11-02T20:17:41+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","fetched_at":"2026-11-02T20:35:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-28588:1419","url":null,"severity":null,"published_at":"2026-11-02T20:37:27+00:00","modified_at":"2026-11-02T20:37:27+00:00","first_seen_at":"2026-11-02T20:37:27+00:00","fetched_at":"2026-11-02T20:37:27+00:00","note":"Primary: Android Nov 2026 bulletin lists CVE-2026-28588 (A-475232460, EoP, High, AOSP 14-17). Bulletin does not describe the bug; NVD page unreadable. Only fix verified. No exploitation reported."}],"documents":[{"id":53783,"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","title":"Android Security Bulletin—November 2026","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":53785,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28588","title":"NVD CVE-2026-28588","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}