CVE-2026-28665 — Vulnerability intelligence

—

Published: 2026-11-02T20:17:42.490

CVSS

8.4

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Sources

• CVE-2026-28665
• Original advisory