Description
In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-06-01
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Local information disclosure
Action: Update Android
AI Analysis

Impact

The vulnerability resides in AppOpsService.java where a permission check has been omitted. This omission permits local users to read sensitive information without acquiring additional privileges or performing any user interaction, thereby compromising confidentiality.

Affected Systems

All Google Android devices running Android 14.0, 15.0, or 16.0—including the qpr2 Beta 1, 2, and 3 releases—are affected. These versions correspond to the listed CPEs for Android 14.0, Android 15.0, and Android 16.0 variants.

Risk and Exploitability

Because the flaw is local and requires no elevated privileges, an attacker with physical or local access can exploit it. The CVSS base score of 3.3 indicates low severity. The EPSS score is < 1%, and the vulnerability is not listed in the KEV catalog, indicating no known active exploitation yet. Nonetheless, the secrecy breach warrants prompt attention, and the lack of user interaction lowers the barrier for misuse.

Generated by OpenCVE AI on November 3, 2026 at 11:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Android security patch that enhances AppOpsService permission checks, thereby addressing the improper restriction of operations (CWE-269).
  • If an immediate update is not possible, enforce a device administration policy that limits privileged application access to AppOpsService, mitigating the improper restriction of operations (CWE-269).
  • Enable comprehensive auditing of AppOpsService operations to detect unauthorized reads, supporting detection of misuses related to the access control weakness.

Generated by OpenCVE AI on November 3, 2026 at 11:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*		 cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*
cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*

Tue, 03 Nov 2026 11:45:00 +0000

Type Values Removed Values Added
Title AppOpsService Permission Bypass Leading to Local Information Disclosure in Android

Tue, 03 Nov 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

 cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Tue, 03 Nov 2026 00:45:00 +0000

Type Values Removed Values Added
Title Permission Check Bypass in Android AppOpsService Allows Local Information Disclosure

Mon, 02 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

 cvssV3_1

{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Mon, 02 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
References

Mon, 02 Nov 2026 20:00:00 +0000

Type Values Removed Values Added
References

Wed, 03 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:* cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*

Tue, 02 Jun 2026 18:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*

Tue, 02 Jun 2026 03:15:00 +0000

Type Values Removed Values Added
Title Permission Check Bypass in Android AppOpsService Allows Local Information Disclosure

Tue, 02 Jun 2026 01:45:00 +0000

Type Values Removed Values Added
Title Missing Permission Check in AppOpsService Leading to Local Information Disclosure
Weaknesses CWE-284

Mon, 01 Jun 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 01 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Title Missing Permission Check in AppOpsService Leading to Local Information Disclosure
First Time appeared Google
Google android
Weaknesses CWE-284
Vendors & Products Google
Google android

Mon, 01 Jun 2026 21:45:00 +0000

Type Values Removed Values Added
Description In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2026-11-02T19:53:01.848Z

Reserved: 2026-03-02T19:11:00.351Z

Link: CVE-2026-28586

cve-icon Vulnrichment

Updated: 2026-06-01T22:26:08.330Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-01T22:16:25.213

Modified: 2026-11-05T19:35:06.073

Link: CVE-2026-28586

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T11:30:09Z

Weaknesses
  • CWE-269

    Improper Privilege Management