CVE-2026-28616: Unknown in Google Android

The vulnerability exists in the Android Setup Wizard component, where a confused deputy condition enables an attacker to coerce the device into connecting to a malicious network. Exploitation does not require user interaction and can result in local escalation of privileges. The CVSS score is 7.8, indicating a high severity with impacts on confidentiality, integrity, and availability. No specific affected versions or patch information are provided in the available data.

Successful exploitation can lead to local privilege escalation, potentially allowing an attacker to gain higher privileges on the device. The vulnerability affects confidentiality, integrity, and availability of the system. No user interaction is required, increasing the risk of silent exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users and administrators should monitor official Google Android security advisories for updates and apply patches once available.