Loading vulnerability…
Android System Improper Encryption-Key Validation Privilege Escalation
CVE-2026-28590 is a critical Android System elevation-of-privilege vulnerability caused by logic errors in multiple locations that perform encryption-key validation. Improper validation of encryption keys can permit a local attacker to bypass intended security checks and escalate privileges. No user interaction or additional execution privileges are required.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables local privilege escalation on an affected Android device. An attacker may obtain privileges beyond those intended by Android System security boundaries, potentially enabling access to protected resources or further compromise when chained with other vulnerabilities.
If you can’t patch tonight, do this now.
Until patches are deployed, restrict unpatched devices from sensitive workloads and enterprise resources, enforce mobile-device-management patch-compliance and access-control policies, and monitor devices for anomalous activity. Keep Android and Google Play system updates current.
Patch, then assume compromise.
Apply the Android security update containing the September 2026 fixes. Devices should be updated to Android security patch level 2026-09-05 or later where applicable, using the update supplied by the device manufacturer.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.