GoogleCVE-2026-28606
Google Android: privilege escalation
Critical9.8CVE-2026-28606 · Published Sep 8, 2026 · updated Sep 15, 2026
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Android Product | <= 17 | No fix yet |
| <= 16-qpr2 | No fix yet | |
| <= 16 | No fix yet | |
| <= 15 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- CISA (its enrichment of the CVE record)
- Weakness
- CWE-287
More Google advisories
All Google| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 8 | Google Android Wear: information disclosure | Critical10.0 | No fix yet |
| Sep 8 | Google Android XR: privilege escalation | Critical10.0 | No fix yet |
| Sep 8 | Google Android: use after free | High7.8 | No fix yet |
| Sep 8 | Google Android: race condition | High7.0 | No fix yet |
| Sep 8 | Google Android: privilege escalation | High7.8 | No fix yet |
| Sep 8 | Google Android: out-of-bounds read | High7.8 | No fix yet |