CVE-2026-28602: Information disclosure in Google Android

The vulnerability CVE-2026-28602 in Google Android arises from a logic error in the setClipboardAccessNotificationsEnabledForUser method within ClipboardService.java. This error leads to a failure in properly isolating clipboard access notifications between users in a multi-user environment. As a result, an attacker with local access can escalate privileges without needing further execution rights or user interaction, potentially gaining unauthorized access to sensitive information or system capabilities.

Successful exploitation of this vulnerability can lead to local privilege escalation and information disclosure on affected Android devices. The attacker does not require additional execution privileges or user interaction, increasing the risk of exploitation by local adversaries. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the official Google Android security advisories for current remediation guidance. Until a fix is available, restrict local access to trusted users and monitor for unusual local activity related to clipboard services.