---
id: "CVE-2026-28621"
kind: "vulnerability"
aliases: ["CVE-2026-28621"]
title: "Android: missing permission check lets apps read ringtone data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure", "mobile"]
not_affected_if: ["patched-android-build"]
published_at: "2026-11-02T20:17:42+00:00"
first_seen_at: "2026-11-02T20:35:26+00:00"
updated_at: "2026-11-02T20:40:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28621", "first_seen_at": "2026-11-02T20:35:26+00:00"}]
---

# Android: missing permission check lets apps read ringtone data

A missing permission check in the Android RingtoneFactory getRingtone code lets an unprivileged app access data it should not reach. An attacker gets local information disclosure, with no extra execution privileges and no user interaction needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T20:35:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28621

## From the sources

In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_