CVE-2026-28615 is a critical vulnerability in Google Android's Telecomm component where a permissions bypass enables unauthorized phone call initiation. Exploitation does not require user interaction or elevated execution privileges, resulting in local escalation of privilege. The vulnerability is identified as CWE-862 (Missing Authorization). The CVSS 4.0 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, and security requirements. No official remediation or patch information is currently available.

Successful exploitation allows an attacker to bypass permission checks and initiate unauthorized phone calls, resulting in local privilege escalation on affected devices. This can compromise device security and potentially lead to further unauthorized actions. The vulnerability has a critical severity rating with a maximum CVSS score of 10.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should monitor official Google Android security advisories for updates. No specific mitigation or workaround is currently documented.