CVE-2026-28664 Google CVE debrief

Who should care

Defenders responsible for Google Android devices and versions should assess exposure and apply patches for this vulnerability. Security teams should review and update inventory of Google Android devices and versions, verify and apply security updates from Google, and review compensating controls for exposed systems while remediation is scheduled and verified. Operators and platform administrators should also be aware of the potential risks and take steps

Why it matters

CVE-2026-28664 is a high-severity vulnerability in Google Android that allows local escalation of privilege, potentially leading to unauthorized access and control, file tampering, and data loss or corruption. Defenders should prioritize assessing exposure and applying patches.

• Local escalation of privilege can lead to unauthorized access and control
• File tampering can result in data loss or corruption
• No additional execution privileges are needed for exploitation

Technical summary

The vulnerability is caused by a logic error in the WriteImageToDisk function of runtime_image.cc, allowing local escalation of privilege with no additional execution privileges needed. This logic error can lead to file tampering and unauthorized access to sensitive data. The vulnerability has been assessed as high-severity and requires immediate attention from defenders. The affected product is Google Android, and defenders should assess exposure and apply patches to mitigate potential risks. The vulnerability can lead to unauthorized access and control, file tampering, and data loss or corruption.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for this vulnerability, as it can lead to local escalation of privilege.

Recommended defensive actions

• Assess exposure and apply patches for CVE-2026-28664
• Review and update inventory of Google Android devices and versions
• Verify and apply security updates from Google
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE Program record and NVD vulnerability detail page. The source.android.com provides additional information on the security bulletin. The source code review indicates a logic error in the WriteImageToDisk function of runtime_image.cc. The CVE Program record and NVD vulnerability detail page provide additional information on the vulnerability. The vulnerability has been assessed as high-severity and requires immediate attention from defenders.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.