CVE-2026-28615: In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass

Synopsis

This is a permissions bypass vulnerability in the Android Telecomm component affecting Android 17. The flaw is reachable over the network with no authentication or user interaction required, and all three impact dimensions (confidentiality, integrity, and availability) are rated high for both the vulnerable system and downstream systems. Successful exploitation allows an attacker to initiate unauthorized phone calls and escalate privileges locally on the device without any additional permissions. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Google publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network (AV:N), meaning an attacker can trigger it remotely without needing physical or local access to the device.

• AuthenticationNot required

  No credentials or existing account are needed (PR:N); the attacker can exploit this as an unauthenticated party.

• Victim interactionNot required

  Exploitation requires no action from a device user (UI:N); the attacker can trigger the flaw entirely without social engineering.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker initiates unauthorized outbound phone calls from the compromised device, bypassing Android's telephony permission model.
• The attacker gains local privilege escalation, elevating their execution context on the device without needing any pre-granted elevated permissions.
• All three confidentiality, integrity, and availability dimensions are rated high for both the vulnerable system and any connected or dependent systems, meaning the attacker reads stored data, modifies system state, and can disrupt device functionality.
• The scope extends beyond the immediate process boundary (SC:H, SI:H, SA:H), so compromise of the Telecomm component can affect other components and services on the same device.