CVE-2026-28580High· 7.8▾ TwilightIn multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.07%
In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Android 17Android 16-qpr2Android 16Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55292Medium· 5.3In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow
CVE-2026-49912Medium· 4.0In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code
CVE-2026-58989High· 8.4In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check
CVE-2026-58995High· 8.4In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow
CVE-2026-59005High· 8.4In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check
CVE-2026-49934High· 7.8In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation