{"id":"CVE-2026-28593","title":"In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI","summary":"In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-356"],"vendor":"google","product":"android","affected":["android = 14.0","android = 15.0","android = 16.0","android = 17.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:25:06.937","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28593","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"epss":0.00074,"epssPercentile":0.00087,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:57:02.435045Z"},"ingestedAt":"2026-09-08T19:08:49.643Z","slug":"CVE-2026-28593","body":"## Overview\n\nIn getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 14.0`\n- `android = 15.0`\n- `android = 16.0`\n- `android = 17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201501,"id":"CVE-2026-28593","ts":1789399510837,"field":"cvss","old":null,"new":"7.8"},{"seq":201500,"id":"CVE-2026-28593","ts":1789399510837,"field":"severity","old":"none","new":"high"},{"seq":200235,"id":"CVE-2026-28593","ts":1789397086234,"field":"cvss","old":"7.8","new":null},{"seq":200234,"id":"CVE-2026-28593","ts":1789397086234,"field":"severity","old":"high","new":"none"},{"seq":198159,"id":"CVE-2026-28593","ts":1789391739199,"field":"cvss","old":null,"new":"7.8"},{"seq":198158,"id":"CVE-2026-28593","ts":1789391739199,"field":"severity","old":"none","new":"high"},{"seq":195952,"id":"CVE-2026-28593","ts":1789383399326,"field":"cvss","old":"7.8","new":null},{"seq":195951,"id":"CVE-2026-28593","ts":1789383399326,"field":"severity","old":"high","new":"none"},{"seq":194881,"id":"CVE-2026-28593","ts":1789380300357,"field":"cvss","old":null,"new":"7.8"},{"seq":194880,"id":"CVE-2026-28593","ts":1789380300357,"field":"severity","old":"none","new":"high"},{"seq":193668,"id":"CVE-2026-28593","ts":1789378268853,"field":"cvss","old":"7.8","new":null},{"seq":193667,"id":"CVE-2026-28593","ts":1789378268853,"field":"severity","old":"high","new":"none"},{"seq":192455,"id":"CVE-2026-28593","ts":1789376233234,"field":"cvss","old":null,"new":"7.8"},{"seq":192454,"id":"CVE-2026-28593","ts":1789376233234,"field":"severity","old":"none","new":"high"},{"seq":191242,"id":"CVE-2026-28593","ts":1789373126551,"field":"cvss","old":"7.8","new":null},{"seq":191241,"id":"CVE-2026-28593","ts":1789373126551,"field":"severity","old":"high","new":"none"},{"seq":190027,"id":"CVE-2026-28593","ts":1789369120971,"field":"cvss","old":null,"new":"7.8"},{"seq":190026,"id":"CVE-2026-28593","ts":1789369120971,"field":"severity","old":"none","new":"high"},{"seq":188814,"id":"CVE-2026-28593","ts":1789368038293,"field":"cvss","old":"7.8","new":null},{"seq":188813,"id":"CVE-2026-28593","ts":1789368038293,"field":"severity","old":"high","new":"none"},{"seq":187597,"id":"CVE-2026-28593","ts":1789364996467,"field":"cvss","old":null,"new":"7.8"},{"seq":187596,"id":"CVE-2026-28593","ts":1789364996467,"field":"severity","old":"none","new":"high"},{"seq":186384,"id":"CVE-2026-28593","ts":1789363002327,"field":"cvss","old":"7.8","new":null},{"seq":186383,"id":"CVE-2026-28593","ts":1789363002327,"field":"severity","old":"high","new":"none"},{"seq":185170,"id":"CVE-2026-28593","ts":1789360969657,"field":"cvss","old":null,"new":"7.8"},{"seq":185169,"id":"CVE-2026-28593","ts":1789360969657,"field":"severity","old":"none","new":"high"},{"seq":183957,"id":"CVE-2026-28593","ts":1789357943350,"field":"cvss","old":"7.8","new":null},{"seq":183956,"id":"CVE-2026-28593","ts":1789357943350,"field":"severity","old":"high","new":"none"},{"seq":182209,"id":"CVE-2026-28593","ts":1789354097845,"field":"cvss","old":null,"new":"7.8"},{"seq":182208,"id":"CVE-2026-28593","ts":1789354097845,"field":"severity","old":"none","new":"high"},{"seq":181002,"id":"CVE-2026-28593","ts":1789352943307,"field":"cvss","old":"7.8","new":null},{"seq":181001,"id":"CVE-2026-28593","ts":1789352943307,"field":"severity","old":"high","new":"none"},{"seq":179795,"id":"CVE-2026-28593","ts":1789350001013,"field":"cvss","old":null,"new":"7.8"},{"seq":179794,"id":"CVE-2026-28593","ts":1789350001013,"field":"severity","old":"none","new":"high"},{"seq":178588,"id":"CVE-2026-28593","ts":1789347814261,"field":"cvss","old":"7.8","new":null},{"seq":178587,"id":"CVE-2026-28593","ts":1789347814261,"field":"severity","old":"high","new":"none"},{"seq":177381,"id":"CVE-2026-28593","ts":1789346181631,"field":"cvss","old":null,"new":"7.8"},{"seq":177380,"id":"CVE-2026-28593","ts":1789346181631,"field":"severity","old":"none","new":"high"},{"seq":176174,"id":"CVE-2026-28593","ts":1789342751940,"field":"cvss","old":"7.8","new":null},{"seq":176173,"id":"CVE-2026-28593","ts":1789342751940,"field":"severity","old":"high","new":"none"},{"seq":175958,"id":"CVE-2026-28593","ts":1789342358452,"field":"cvss","old":null,"new":"7.8"},{"seq":175957,"id":"CVE-2026-28593","ts":1789342358452,"field":"severity","old":"none","new":"high"},{"seq":175498,"id":"CVE-2026-28593","ts":1789338389954,"field":"cvss","old":"7.8","new":null},{"seq":175497,"id":"CVE-2026-28593","ts":1789338389954,"field":"severity","old":"high","new":"none"},{"seq":174293,"id":"CVE-2026-28593","ts":1789334603857,"field":"cvss","old":null,"new":"7.8"},{"seq":174292,"id":"CVE-2026-28593","ts":1789334603857,"field":"severity","old":"none","new":"high"},{"seq":173088,"id":"CVE-2026-28593","ts":1789333197365,"field":"cvss","old":"7.8","new":null},{"seq":173087,"id":"CVE-2026-28593","ts":1789333197365,"field":"severity","old":"high","new":"none"},{"seq":171902,"id":"CVE-2026-28593","ts":1789330883544,"field":"cvss","old":null,"new":"7.8"},{"seq":171901,"id":"CVE-2026-28593","ts":1789330883544,"field":"severity","old":"none","new":"high"}]}