CVE-2026-28606

Android allows users to cause a denial of service.

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure without additional execution privileges. User interaction is not needed.

In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.

In multiple locations, there is a possible memory safety issue due to integer overflow. This could lead to local escalation of privilege with no additional execution privileges required.

In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In the parseParts function of PduParser.java, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to local privilege escalation without additional execution privileges. User interaction is not required for exploitation.

In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local privilege escalation without additional execution privileges. User interaction is not required for exploitation.