{"id":"CVE-2026-28620","title":"In multiple locations, there is a possible unauthorized URI access due to a permissions bypass","summary":"In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-863"],"vendor":"google","product":"android","affected":["android = 16.0","android = 17.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:24:21.747","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28620","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"epss":0.00068,"epssPercentile":0.00034,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:57:13.986914Z"},"ingestedAt":"2026-09-08T19:08:49.642Z","slug":"CVE-2026-28620","body":"## Overview\n\nIn multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 16.0`\n- `android = 17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201537,"id":"CVE-2026-28620","ts":1789399510947,"field":"cvss","old":null,"new":"7.8"},{"seq":201536,"id":"CVE-2026-28620","ts":1789399510947,"field":"severity","old":"none","new":"high"},{"seq":200271,"id":"CVE-2026-28620","ts":1789397086361,"field":"cvss","old":"7.8","new":null},{"seq":200270,"id":"CVE-2026-28620","ts":1789397086361,"field":"severity","old":"high","new":"none"},{"seq":198195,"id":"CVE-2026-28620","ts":1789391741843,"field":"cvss","old":null,"new":"7.8"},{"seq":198194,"id":"CVE-2026-28620","ts":1789391741843,"field":"severity","old":"none","new":"high"},{"seq":195988,"id":"CVE-2026-28620","ts":1789383399449,"field":"cvss","old":"7.8","new":null},{"seq":195987,"id":"CVE-2026-28620","ts":1789383399449,"field":"severity","old":"high","new":"none"},{"seq":194917,"id":"CVE-2026-28620","ts":1789380300471,"field":"cvss","old":null,"new":"7.8"},{"seq":194916,"id":"CVE-2026-28620","ts":1789380300471,"field":"severity","old":"none","new":"high"},{"seq":193704,"id":"CVE-2026-28620","ts":1789378268985,"field":"cvss","old":"7.8","new":null},{"seq":193703,"id":"CVE-2026-28620","ts":1789378268985,"field":"severity","old":"high","new":"none"},{"seq":192491,"id":"CVE-2026-28620","ts":1789376233364,"field":"cvss","old":null,"new":"7.8"},{"seq":192490,"id":"CVE-2026-28620","ts":1789376233364,"field":"severity","old":"none","new":"high"},{"seq":191278,"id":"CVE-2026-28620","ts":1789373126674,"field":"cvss","old":"7.8","new":null},{"seq":191277,"id":"CVE-2026-28620","ts":1789373126674,"field":"severity","old":"high","new":"none"},{"seq":190063,"id":"CVE-2026-28620","ts":1789369121105,"field":"cvss","old":null,"new":"7.8"},{"seq":190062,"id":"CVE-2026-28620","ts":1789369121105,"field":"severity","old":"none","new":"high"},{"seq":188850,"id":"CVE-2026-28620","ts":1789368038417,"field":"cvss","old":"7.8","new":null},{"seq":188849,"id":"CVE-2026-28620","ts":1789368038417,"field":"severity","old":"high","new":"none"},{"seq":187633,"id":"CVE-2026-28620","ts":1789364996575,"field":"cvss","old":null,"new":"7.8"},{"seq":187632,"id":"CVE-2026-28620","ts":1789364996575,"field":"severity","old":"none","new":"high"},{"seq":186420,"id":"CVE-2026-28620","ts":1789363002447,"field":"cvss","old":"7.8","new":null},{"seq":186419,"id":"CVE-2026-28620","ts":1789363002447,"field":"severity","old":"high","new":"none"},{"seq":185206,"id":"CVE-2026-28620","ts":1789360969767,"field":"cvss","old":null,"new":"7.8"},{"seq":185205,"id":"CVE-2026-28620","ts":1789360969767,"field":"severity","old":"none","new":"high"},{"seq":183993,"id":"CVE-2026-28620","ts":1789357943471,"field":"cvss","old":"7.8","new":null},{"seq":183992,"id":"CVE-2026-28620","ts":1789357943471,"field":"severity","old":"high","new":"none"},{"seq":182245,"id":"CVE-2026-28620","ts":1789354097956,"field":"cvss","old":null,"new":"7.8"},{"seq":182244,"id":"CVE-2026-28620","ts":1789354097956,"field":"severity","old":"none","new":"high"},{"seq":181038,"id":"CVE-2026-28620","ts":1789352943447,"field":"cvss","old":"7.8","new":null},{"seq":181037,"id":"CVE-2026-28620","ts":1789352943447,"field":"severity","old":"high","new":"none"},{"seq":179831,"id":"CVE-2026-28620","ts":1789350001152,"field":"cvss","old":null,"new":"7.8"},{"seq":179830,"id":"CVE-2026-28620","ts":1789350001152,"field":"severity","old":"none","new":"high"},{"seq":178624,"id":"CVE-2026-28620","ts":1789347814386,"field":"cvss","old":"7.8","new":null},{"seq":178623,"id":"CVE-2026-28620","ts":1789347814386,"field":"severity","old":"high","new":"none"},{"seq":177417,"id":"CVE-2026-28620","ts":1789346181769,"field":"cvss","old":null,"new":"7.8"},{"seq":177416,"id":"CVE-2026-28620","ts":1789346181769,"field":"severity","old":"none","new":"high"},{"seq":176210,"id":"CVE-2026-28620","ts":1789342752071,"field":"cvss","old":"7.8","new":null},{"seq":176209,"id":"CVE-2026-28620","ts":1789342752071,"field":"severity","old":"high","new":"none"},{"seq":175994,"id":"CVE-2026-28620","ts":1789342358575,"field":"cvss","old":null,"new":"7.8"},{"seq":175993,"id":"CVE-2026-28620","ts":1789342358575,"field":"severity","old":"none","new":"high"},{"seq":175534,"id":"CVE-2026-28620","ts":1789338390074,"field":"cvss","old":"7.8","new":null},{"seq":175533,"id":"CVE-2026-28620","ts":1789338390074,"field":"severity","old":"high","new":"none"},{"seq":174329,"id":"CVE-2026-28620","ts":1789334604821,"field":"cvss","old":null,"new":"7.8"},{"seq":174328,"id":"CVE-2026-28620","ts":1789334604821,"field":"severity","old":"none","new":"high"},{"seq":173124,"id":"CVE-2026-28620","ts":1789333197493,"field":"cvss","old":"7.8","new":null},{"seq":173123,"id":"CVE-2026-28620","ts":1789333197493,"field":"severity","old":"high","new":"none"},{"seq":171938,"id":"CVE-2026-28620","ts":1789330884538,"field":"cvss","old":null,"new":"7.8"},{"seq":171937,"id":"CVE-2026-28620","ts":1789330884538,"field":"severity","old":"none","new":"high"}]}