AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GoogleCVE-2026-28627

Google Android: information disclosure

Google

CVE-2026-28627 · Published Sep 8, 2026 · updated Sep 15, 2026

Medium4.3
No fix yet
Google advisory

In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected versions

PackageAffectedFixed in
Android
Product
<= 17No fix yet
<= 16-qpr2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-693

More Google advisories

All Google
Critical 10.0Sep 8Google Android Wear: information disclosureCVE-2026-49883no fix yetCritical 10.0Sep 8Google Android XR: privilege escalationCVE-2026-28659no fix yetHigh 7.8Sep 8Google Android: use after freeCVE-2026-58846no fix yetHigh 7.0Sep 8Google Android: race conditionCVE-2026-58848no fix yetHigh 7.8Sep 8Google Android: privilege escalationCVE-2026-58874no fix yetHigh 7.8Sep 8Google Android: out-of-bounds readCVE-2026-58941no fix yet