CVE-2026-28659
Quick assessment
Affected
Google Android XR
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 MicroXR Blobstore 中，由于缺少权限检查，可能存在一种方式可以访问其他应用程序的文件。这可能导致本地权限提升，且无需额外的执行权限。利用该漏洞不需要用户交互。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Android XR | 14 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-28659
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Android XR | 14 | - |
|
II. Public POCs for CVE-2026-28659
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28659
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-28659 (1)
Same Patch Batch · Google · 2026-09-08 · 91 CVEs total
| CVE-2026-49883 | 10.0 CRITICAL | PermissionsManager缺失权限检查致本地信息泄露 |
| CVE-2026-19201 | 6.6 MEDIUM | Denial of Service via Unbounded Recursion in go-attestation Windows SIPA Parser |
| CVE-2026-28636 | 安卓PickActivity混淆代理致未知应用安装限制绕过 | |
| CVE-2026-28616 | Windows Setup Wizard 特权提升漏洞 | |
| CVE-2026-28642 | ActivityStarter逻辑错误致本地提权 | |
| CVE-2026-28644 | Android ActivityTaskManagerService权限绕过漏洞 | |
| CVE-2026-28650 | WindowState中setHiddenWhileSuspended逻辑错误致提权 | |
| CVE-2026-28652 | RangingServiceImpl缺少权限校验致远程信息泄露 | |
| CVE-2026-0054 | WalletContextualLocationsService 权限校验缺失导致本地信息泄露 | |
| CVE-2026-28639 | Media Framework组件本地权限提升漏洞 | |
| CVE-2026-28630 | Android ContactsPicker 点击劫持致信息泄露 | |
| CVE-2026-28627 | btm_sec.cc 信息泄露 | |
| CVE-2026-28626 | SetupPassthroughActivity 意图重定向致本地提权 | |
| CVE-2026-28624 | 软件本地权限提升漏洞 | |
| CVE-2026-28623 | 蓝牙RSSI功能缺失权限校验致MAC地址泄露 | |
| CVE-2026-28622 | MediaProvider权限绕过致位置信息泄露 | |
| CVE-2026-28620 | 软件多权限绕过致本地提权漏洞 | |
| CVE-2026-28618 | oapv.c中dec_frm_prepare函数堆溢出致远程代码执行 | |
| CVE-2026-28617 | WifiNetworkSuggestionsManager资源耗尽致本地DoS | |
| CVE-2026-28653 | rw_t3t.cc 整数溢出导致越界写及本地提权 |
Showing top 20 of 91 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Android XR
V. Comments for CVE-2026-28659
No comments yet