CVE-2026-28660 Google CVE debrief

Who should care

Defenders responsible for Android device security, particularly those managing enterprise or personal Android devices, should assess exposure and prioritize patching. This includes IT teams handling Android device management, security teams monitoring for potential threats, and administrators responsible for applying patches and updates. Additionally, operators of Android-based systems and services should be aware of the vulnerability and take necessary to

Why it matters

CVE-2026-28660 is a local information disclosure vulnerability in Android that allows for information disclosure without additional execution privileges. Defenders should prioritize patching affected versions.

• Local information disclosure possible without additional execution privileges
• No user interaction required for exploitation
• CVSS score of 3.3 indicates low severity
• Patching required for affected Android versions

Technical summary

The vulnerability is caused by a logic error in multiple Android files, specifically in the getAllSessions function. This could lead to local information disclosure with no additional execution privileges needed. The vulnerability has a CVSS score of 3.3 and is considered low severity. User interaction is not needed for exploitation. Defenders should prioritize verifying and applying patches from Google for affected Android versions 15.0, 16.0, and 17.0. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize verifying and applying patches from the vendor, Google, for affected Android versions 15.0, 16.0, and 17.0.

Recommended defensive actions

• Verify and apply patches from Google for affected Android versions
• Inventory Android devices and check for updates
• Monitor for local exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish specific exploitation or impact, requiring verification from official sources. Defenders should verify and apply patches from Google for affected Android versions 15.0, 16.0, and 17.0. The vulnerability is caused by a logic error in multiple Android files, specifically in the getAllSessions function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.