CVE-2026-28666 Google CVE debrief

Who should care

Defenders responsible for Google Android versions 14.0, 15.0, 16.0, 16.0 QPR2, and 17.0 should assess exposure and prioritize patching. This includes security teams, vulnerability management teams, and operators responsible for maintaining affected Android versions. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change

Why it matters

CVE-2026-28666 is a high-severity vulnerability in Google Android that could lead to remote escalation of privilege. Defenders should prioritize patching and assessing exposure in affected versions.

• Remote Denial of Service exploitation requires no user interaction
• Potential for remote escalation of privilege without additional execution privileges
• Need for verification of exposure in affected Android versions
• Priority on applying patches from Google

Technical summary

A vulnerability in LocalImageResolver.java allows for Remote Persistent Denial of Service due to a DNG image rendering check bypass, potentially leading to remote escalation of privilege without additional execution privileges needed. The vulnerability has a CVSS score of 8.8 and affects Google Android versions 14.0, 15.0, 16.0, 16.0 QPR2, and 17.0. Defenders should prioritize verifying and applying patches from Google, assessing exposure in affected Android versions, and monitoring for potential exploitation attempts.

Defensive priority

Defenders should prioritize verifying and applying patches from Google, assessing exposure in Android versions 14.0, 15.0, 16.0, 16.0 QPR2, and 17.0, and monitoring for potential exploitation attempts.

Recommended defensive actions

• Verify and apply patches from Google for affected Android versions
• Assess exposure in Android versions 14.0, 15.0, 16.0, 16.0 QPR2, and 17.0
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.8 and affected Android versions. However, specific details on exploitation or victim impact are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.