CVE-2026-28588 is a high-severity vulnerability in the shouldBlockDirectoryFromTree function of ExternalStorageProvider.java. A logic error in this code allows unauthorized local access to protected data, resulting in local privilege escalation without requiring additional execution privileges or user interaction.