Vulnerability · Google Android
CVE-2026-28580
In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS score (v3.1)7.8High
Not on CISA KEV list
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- Last updated by NVD
Affected products
| Product | Versions |
|---|---|
| Google Android | 16.0 only; 16.0-qpr2_beta_1 only; 16.0-qpr2_beta_2 only; 16.0-qpr2_beta_3 only |
Sources: NVD and CISA known exploited vulnerabilities catalogue.