CVE-2026-28580: In multiple functions, there is a possible desync in persistence due to an incorrect bounds check

Synopsis

An incorrect bounds check in multiple Android system functions allows a local attacker to desync persistent state and escalate privileges. The vulnerability is reachable locally, meaning the attacker needs an existing shell or process on the device, but requires no additional elevated permissions beyond a low-privilege account. Successful exploitation grants full local privilege escalation, giving the attacker control over the device's confidentiality, integrity, and availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required.

• AuthenticationRequired

  The attacker must hold a low-privilege account or process on the device, but no admin or elevated permissions are required beyond that.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the bounds-check desync entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout randomization, or other variable environmental factors.

Blast Radius

• Reads arbitrary files and data belonging to other applications or system processes on the device.
• Modifies or corrupts persistent system state, including settings, application data, and security policies.
• Crashes or destabilizes the affected device, causing service disruption to all running applications.
• Achieves full privilege escalation, gaining the same capabilities as a privileged system process.