Live › vulnerability › CVE-2026-28645
A logic error in Android's UsbService.java lets USB data be enabled without user authentication. An attacker with physical access to a locked device could use this to gain higher privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Android devices with physical access by an attacker. The sources do not name specific Android versions or device models. Devices with a current security patch are not expected to be affected, but the sources do not confirm which patch level fixes it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-28645")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.