CVE-2026-28659: Vulnerability in Google Android XR

The vulnerability exists in the MicroXR Blobstore of Google Android XR version 14, where a missing permission check permits unauthorized access to other applications' files. This flaw enables local escalation of privilege without needing user interaction or elevated execution privileges. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

An attacker with local access can exploit this vulnerability to gain unauthorized access to other apps' files, resulting in a full local privilege escalation. This could compromise the confidentiality, integrity, and availability of data on the affected device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict local access to trusted users and monitor for suspicious activity related to MicroXR Blobstore.