Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-28671 EUVD-2026-73996GHSA-536m-8xwr-6r8p

In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local inf…

Published Sep 8, 2026 · Updated Sep 10, 2026 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

VendorProductAffectedFixed
Google Android 17, 16-qpr2, 16, 15, 14 —

Advisories 1

References