CVE-2026-28667: Information disclosure in Google Android

This vulnerability involves an out-of-bounds read in multiple functions within the rw_t5t.cc file of Google Android. The root cause is a missing bounds check, which can result in local information disclosure. The flaw does not require elevated privileges or user interaction to exploit. The affected Android versions explicitly include 14, 15, 16, 16-qpr2, and 17. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

Successful exploitation could allow a local attacker to read sensitive information from memory due to the out-of-bounds read condition. This information disclosure does not require additional execution privileges or user interaction, potentially increasing the risk of exposure on affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data.