CVE-2026-28586 — Vulnerability intelligence

google — android

Published: 2026-06-01T22:16:25.213

CVSS

3.3

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Sources

• CVE-2026-28586
• Original advisory