CVE-2026-28657 Google CVE debrief

Who should care

Defenders responsible for Google Android systems, particularly those using versions 16.0 and 17.0, should assess exposure and apply patches or compensating controls. Defenders should prioritize assessing exposure and applying patches for Android versions 16.0 and 17.0. Verify affected versions and apply compensating controls if patches are not available. The vulnerability requires immediate attention from defenders, and they should review compensating and

Why it matters

CVE-2026-28657 is a high-severity vulnerability in Google Android, allowing local escalation of privilege. Defenders should prioritize assessing exposure and applying patches or compensating controls.

• Local escalation of privilege requires immediate attention from defenders
• Verify affected versions and apply patches or compensating controls

Technical summary

The vulnerability is caused by a possible unauthorized URI permission grant due to a confused deputy in AppWidgetConfigActivityProxy.java. This could lead to local escalation of privilege with no additional execution privileges needed. The issue affects Android versions 16.0 and 17.0, and defenders should assess exposure and apply patches or compensating controls accordingly. The vulnerability has a CVSS score of 7.8 and is considered high-severity. The issue requires immediate attention from defenders, and they should verify affected versions and apply patches or compensating controls if patches are not available.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Android versions 16.0 and 17.0. Verify affected versions and apply compensating controls if patches are not available.

Recommended defensive actions

• Assess exposure for Android versions 16.0 and 17.0
• Apply patches from Google
• Verify affected versions and apply compensating controls if patches are not available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability. A vendor advisory and patch are available from Google. The vulnerability affects Android versions 16.0 and 17.0, and defenders should verify affected versions and apply patches or compensating controls if patches are not available. The issue is caused by a possible unauthorized URI permission grant due to a confused deputy in AppWidgetConfigActivityProxy.java.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.