{"id":"CVE-2026-28671","title":"In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition","summary":"In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-367"],"vendor":"Google","product":"Android","affected":["Android 17","Android 16-qpr2","Android 16","Android 15","Android 14"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T17:17:03.960","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28671","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T16:13:45.642686Z"},"epss":0.00057,"epssPercentile":0.00007,"ingestedAt":"2026-09-08T19:08:49.641Z","slug":"CVE-2026-28671","body":"## Overview\n\nIn updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201593,"id":"CVE-2026-28671","ts":1789399511131,"field":"cvss","old":null,"new":"3.3"},{"seq":201592,"id":"CVE-2026-28671","ts":1789399511131,"field":"severity","old":"none","new":"low"},{"seq":200325,"id":"CVE-2026-28671","ts":1789397086567,"field":"cvss","old":"3.3","new":null},{"seq":200324,"id":"CVE-2026-28671","ts":1789397086567,"field":"severity","old":"low","new":"none"},{"seq":198249,"id":"CVE-2026-28671","ts":1789391746096,"field":"cvss","old":null,"new":"3.3"},{"seq":198248,"id":"CVE-2026-28671","ts":1789391746096,"field":"severity","old":"none","new":"low"},{"seq":196042,"id":"CVE-2026-28671","ts":1789383399664,"field":"cvss","old":"3.3","new":null},{"seq":196041,"id":"CVE-2026-28671","ts":1789383399664,"field":"severity","old":"low","new":"none"},{"seq":194971,"id":"CVE-2026-28671","ts":1789380300655,"field":"cvss","old":null,"new":"3.3"},{"seq":194970,"id":"CVE-2026-28671","ts":1789380300655,"field":"severity","old":"none","new":"low"},{"seq":193758,"id":"CVE-2026-28671","ts":1789378269185,"field":"cvss","old":"3.3","new":null},{"seq":193757,"id":"CVE-2026-28671","ts":1789378269185,"field":"severity","old":"low","new":"none"},{"seq":192545,"id":"CVE-2026-28671","ts":1789376233568,"field":"cvss","old":null,"new":"3.3"},{"seq":192544,"id":"CVE-2026-28671","ts":1789376233568,"field":"severity","old":"none","new":"low"},{"seq":191332,"id":"CVE-2026-28671","ts":1789373126870,"field":"cvss","old":"3.3","new":null},{"seq":191331,"id":"CVE-2026-28671","ts":1789373126870,"field":"severity","old":"low","new":"none"},{"seq":190117,"id":"CVE-2026-28671","ts":1789369121313,"field":"cvss","old":null,"new":"3.3"},{"seq":190116,"id":"CVE-2026-28671","ts":1789369121313,"field":"severity","old":"none","new":"low"},{"seq":188904,"id":"CVE-2026-28671","ts":1789368038619,"field":"cvss","old":"3.3","new":null},{"seq":188903,"id":"CVE-2026-28671","ts":1789368038619,"field":"severity","old":"low","new":"none"},{"seq":187687,"id":"CVE-2026-28671","ts":1789364996749,"field":"cvss","old":null,"new":"3.3"},{"seq":187686,"id":"CVE-2026-28671","ts":1789364996749,"field":"severity","old":"none","new":"low"},{"seq":186474,"id":"CVE-2026-28671","ts":1789363002680,"field":"cvss","old":"3.3","new":null},{"seq":186473,"id":"CVE-2026-28671","ts":1789363002680,"field":"severity","old":"low","new":"none"},{"seq":185260,"id":"CVE-2026-28671","ts":1789360969947,"field":"cvss","old":null,"new":"3.3"},{"seq":185259,"id":"CVE-2026-28671","ts":1789360969947,"field":"severity","old":"none","new":"low"},{"seq":184047,"id":"CVE-2026-28671","ts":1789357943671,"field":"cvss","old":"3.3","new":null},{"seq":184046,"id":"CVE-2026-28671","ts":1789357943671,"field":"severity","old":"low","new":"none"},{"seq":182299,"id":"CVE-2026-28671","ts":1789354098136,"field":"cvss","old":null,"new":"3.3"},{"seq":182298,"id":"CVE-2026-28671","ts":1789354098136,"field":"severity","old":"none","new":"low"},{"seq":181092,"id":"CVE-2026-28671","ts":1789352943677,"field":"cvss","old":"3.3","new":null},{"seq":181091,"id":"CVE-2026-28671","ts":1789352943677,"field":"severity","old":"low","new":"none"},{"seq":179885,"id":"CVE-2026-28671","ts":1789350001363,"field":"cvss","old":null,"new":"3.3"},{"seq":179884,"id":"CVE-2026-28671","ts":1789350001363,"field":"severity","old":"none","new":"low"},{"seq":178678,"id":"CVE-2026-28671","ts":1789347814586,"field":"cvss","old":"3.3","new":null},{"seq":178677,"id":"CVE-2026-28671","ts":1789347814586,"field":"severity","old":"low","new":"none"},{"seq":177471,"id":"CVE-2026-28671","ts":1789346181938,"field":"cvss","old":null,"new":"3.3"},{"seq":177470,"id":"CVE-2026-28671","ts":1789346181938,"field":"severity","old":"none","new":"low"},{"seq":176264,"id":"CVE-2026-28671","ts":1789342752264,"field":"cvss","old":"3.3","new":null},{"seq":176263,"id":"CVE-2026-28671","ts":1789342752264,"field":"severity","old":"low","new":"none"},{"seq":176048,"id":"CVE-2026-28671","ts":1789342358771,"field":"cvss","old":null,"new":"3.3"},{"seq":176047,"id":"CVE-2026-28671","ts":1789342358771,"field":"severity","old":"none","new":"low"},{"seq":175588,"id":"CVE-2026-28671","ts":1789338390266,"field":"cvss","old":"3.3","new":null},{"seq":175587,"id":"CVE-2026-28671","ts":1789338390266,"field":"severity","old":"low","new":"none"},{"seq":174383,"id":"CVE-2026-28671","ts":1789334604997,"field":"cvss","old":null,"new":"3.3"},{"seq":174382,"id":"CVE-2026-28671","ts":1789334604997,"field":"severity","old":"none","new":"low"},{"seq":173178,"id":"CVE-2026-28671","ts":1789333198033,"field":"cvss","old":"3.3","new":null},{"seq":173177,"id":"CVE-2026-28671","ts":1789333198033,"field":"severity","old":"low","new":"none"},{"seq":171992,"id":"CVE-2026-28671","ts":1789330884723,"field":"cvss","old":null,"new":"3.3"},{"seq":171991,"id":"CVE-2026-28671","ts":1789330884723,"field":"severity","old":"none","new":"low"}]}