{"id":"CVE-2026-28624","title":"In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy","summary":"In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-441"],"vendor":"google","product":"android","affected":["android = 16.0","android = 17.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:07:53.667","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28624","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"epss":0.00067,"epssPercentile":0.00029,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:57:15.142253Z"},"ingestedAt":"2026-09-08T19:08:49.642Z","slug":"CVE-2026-28624","body":"## Overview\n\nIn multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 16.0`\n- `android = 17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201543,"id":"CVE-2026-28624","ts":1789399510966,"field":"cvss","old":null,"new":"7.8"},{"seq":201542,"id":"CVE-2026-28624","ts":1789399510966,"field":"severity","old":"none","new":"high"},{"seq":200277,"id":"CVE-2026-28624","ts":1789397086382,"field":"cvss","old":"7.8","new":null},{"seq":200276,"id":"CVE-2026-28624","ts":1789397086382,"field":"severity","old":"high","new":"none"},{"seq":198201,"id":"CVE-2026-28624","ts":1789391742279,"field":"cvss","old":null,"new":"7.8"},{"seq":198200,"id":"CVE-2026-28624","ts":1789391742279,"field":"severity","old":"none","new":"high"},{"seq":195994,"id":"CVE-2026-28624","ts":1789383399472,"field":"cvss","old":"7.8","new":null},{"seq":195993,"id":"CVE-2026-28624","ts":1789383399472,"field":"severity","old":"high","new":"none"},{"seq":194923,"id":"CVE-2026-28624","ts":1789380300490,"field":"cvss","old":null,"new":"7.8"},{"seq":194922,"id":"CVE-2026-28624","ts":1789380300490,"field":"severity","old":"none","new":"high"},{"seq":193710,"id":"CVE-2026-28624","ts":1789378269008,"field":"cvss","old":"7.8","new":null},{"seq":193709,"id":"CVE-2026-28624","ts":1789378269008,"field":"severity","old":"high","new":"none"},{"seq":192497,"id":"CVE-2026-28624","ts":1789376233386,"field":"cvss","old":null,"new":"7.8"},{"seq":192496,"id":"CVE-2026-28624","ts":1789376233386,"field":"severity","old":"none","new":"high"},{"seq":191284,"id":"CVE-2026-28624","ts":1789373126694,"field":"cvss","old":"7.8","new":null},{"seq":191283,"id":"CVE-2026-28624","ts":1789373126694,"field":"severity","old":"high","new":"none"},{"seq":190069,"id":"CVE-2026-28624","ts":1789369121127,"field":"cvss","old":null,"new":"7.8"},{"seq":190068,"id":"CVE-2026-28624","ts":1789369121127,"field":"severity","old":"none","new":"high"},{"seq":188856,"id":"CVE-2026-28624","ts":1789368038437,"field":"cvss","old":"7.8","new":null},{"seq":188855,"id":"CVE-2026-28624","ts":1789368038437,"field":"severity","old":"high","new":"none"},{"seq":187639,"id":"CVE-2026-28624","ts":1789364996593,"field":"cvss","old":null,"new":"7.8"},{"seq":187638,"id":"CVE-2026-28624","ts":1789364996593,"field":"severity","old":"none","new":"high"},{"seq":186426,"id":"CVE-2026-28624","ts":1789363002474,"field":"cvss","old":"7.8","new":null},{"seq":186425,"id":"CVE-2026-28624","ts":1789363002474,"field":"severity","old":"high","new":"none"},{"seq":185212,"id":"CVE-2026-28624","ts":1789360969786,"field":"cvss","old":null,"new":"7.8"},{"seq":185211,"id":"CVE-2026-28624","ts":1789360969786,"field":"severity","old":"none","new":"high"},{"seq":183999,"id":"CVE-2026-28624","ts":1789357943492,"field":"cvss","old":"7.8","new":null},{"seq":183998,"id":"CVE-2026-28624","ts":1789357943492,"field":"severity","old":"high","new":"none"},{"seq":182251,"id":"CVE-2026-28624","ts":1789354097975,"field":"cvss","old":null,"new":"7.8"},{"seq":182250,"id":"CVE-2026-28624","ts":1789354097975,"field":"severity","old":"none","new":"high"},{"seq":181044,"id":"CVE-2026-28624","ts":1789352943471,"field":"cvss","old":"7.8","new":null},{"seq":181043,"id":"CVE-2026-28624","ts":1789352943471,"field":"severity","old":"high","new":"none"},{"seq":179837,"id":"CVE-2026-28624","ts":1789350001171,"field":"cvss","old":null,"new":"7.8"},{"seq":179836,"id":"CVE-2026-28624","ts":1789350001171,"field":"severity","old":"none","new":"high"},{"seq":178630,"id":"CVE-2026-28624","ts":1789347814407,"field":"cvss","old":"7.8","new":null},{"seq":178629,"id":"CVE-2026-28624","ts":1789347814407,"field":"severity","old":"high","new":"none"},{"seq":177423,"id":"CVE-2026-28624","ts":1789346181787,"field":"cvss","old":null,"new":"7.8"},{"seq":177422,"id":"CVE-2026-28624","ts":1789346181787,"field":"severity","old":"none","new":"high"},{"seq":176216,"id":"CVE-2026-28624","ts":1789342752091,"field":"cvss","old":"7.8","new":null},{"seq":176215,"id":"CVE-2026-28624","ts":1789342752091,"field":"severity","old":"high","new":"none"},{"seq":176000,"id":"CVE-2026-28624","ts":1789342358595,"field":"cvss","old":null,"new":"7.8"},{"seq":175999,"id":"CVE-2026-28624","ts":1789342358595,"field":"severity","old":"none","new":"high"},{"seq":175540,"id":"CVE-2026-28624","ts":1789338390093,"field":"cvss","old":"7.8","new":null},{"seq":175539,"id":"CVE-2026-28624","ts":1789338390093,"field":"severity","old":"high","new":"none"},{"seq":174335,"id":"CVE-2026-28624","ts":1789334604839,"field":"cvss","old":null,"new":"7.8"},{"seq":174334,"id":"CVE-2026-28624","ts":1789334604839,"field":"severity","old":"none","new":"high"},{"seq":173130,"id":"CVE-2026-28624","ts":1789333197513,"field":"cvss","old":"7.8","new":null},{"seq":173129,"id":"CVE-2026-28624","ts":1789333197513,"field":"severity","old":"high","new":"none"},{"seq":171944,"id":"CVE-2026-28624","ts":1789330884556,"field":"cvss","old":null,"new":"7.8"},{"seq":171943,"id":"CVE-2026-28624","ts":1789330884556,"field":"severity","old":"none","new":"high"}]}