CVE-2026-28622 Google CVE debrief

Who should care

Defenders responsible for Google Android deployments should assess exposure and prioritize patching or mitigation. They should verify the presence of this vulnerability in their Android deployments and apply patches or mitigations as available. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-28622 is a low-severity vulnerability in Google Android that allows for local information disclosure due to a permissions bypass. Defenders should prioritize verifying the presence of this vulnerability in their Android deployments and applying patches or mitigations as available.

• Local information disclosure possible due to permissions bypass
• No additional execution privileges required for exploitation
• User interaction not needed for exploitation
• Verify patch deployment and monitor for exploitation attempts

Technical summary

The vulnerability is located in the getQueryBuilderInternal function of MediaProvider.java and allows for local information disclosure due to a permissions bypass. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Defenders should prioritize verifying the presence of this vulnerability in their Android deployments and applying patches or mitigations as available. The vulnerability has a CVSS score of 3.3 and requires no additional execution privileges or user interaction for exploitation. User interaction is not needed for exploitation.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Android deployments and applying patches or mitigations as available.

Recommended defensive actions

• Verify the presence of this vulnerability in Android deployments
• Apply patches or mitigations as available
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score, description, and affected versions. A vendor advisory is available from Google. Defenders should verify the presence of this vulnerability in their Android deployments and review the official advisory for affected scope, severity, and vendor guidance. The vulnerability has a CVSS score of 3.3 and requires no additional execution privileges or user interaction for exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.