CVE-2026-28639: Remote code execution in Google Android

The vulnerability CVE-2026-28639 exists in the rw_mfc_handle_read_op function within the rw_mfc.cc source file of Google Android. A logic error leads to a possible out-of-bounds write condition. Exploitation of this flaw can result in local privilege escalation, enabling an attacker with limited privileges to gain higher privileges on the device. No user interaction is required for exploitation, and no additional execution privileges are needed to trigger the vulnerability.

Successful exploitation of this vulnerability can lead to a complete compromise of the affected Android device's security context by escalating local privileges. This can allow an attacker to execute arbitrary code with elevated privileges, potentially leading to full device control. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed—check the official Google Android security advisories for current remediation guidance. Until a fix is available, limit local access to trusted users and monitor for suspicious activity related to privilege escalation attempts.