CVE-2026-28573: In AndroidManifest

Synopsis

This is a persistent denial-of-service vulnerability in Google Android (versions 14 and 16) caused by a missing permission check in AndroidManifest.xml. Despite the description noting local impact, the CVSS v4.0 vector is rated 10.0 (Critical) with network-reachable, no-authentication, no-interaction scope across both vulnerable and subsequent system components. Successful exploitation allows an attacker to permanently disrupt the affected Android service, with full confidentiality, integrity, and availability impact scored across system scope. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Google publishes an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The CVSS v4.0 vector specifies AV:N, meaning the attacker must be able to reach the affected service over the network to trigger the vulnerability.

• AuthenticationNot required

  PR:N in the vector indicates no account or privilege level is needed before launching the attack.

• Victim interactionNot required

  UI:N confirms no user action such as clicking a link or opening a file is required for exploitation.

• Attack complexityDetail

  AC:L with AT:N means the exploit is reliable and requires no special conditions, race timing, or environmental configuration to succeed.

Blast Radius

• An attacker can permanently crash or disable the targeted Android service, requiring a device reset or manual intervention to restore normal operation.
• Full confidentiality impact (VC:H, SC:H) means an attacker reads protected data stored by the affected service, including any credentials or session material accessible to that process.
• Full integrity impact (VI:H, SI:H) means an attacker modifies persisted data or system state managed by the affected component.
• Full availability impact (VA:H, SA:H) means the attacker renders both the directly affected component and dependent system services completely unresponsive.