Is CVE-2026-28640 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-28640

Description

In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.