CVE-2026-28588 in Android
Summary
by MITRE • 11/02/2026
In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified within the shouldBlockDirectoryFromTree method of ExternalStorageProvider.java represents a critical logical flaw in Android's external storage access control mechanisms. As a cyber security specialist, it is evident that this logic error undermines the intended isolation between applications and protected system directories or user data partitions. The core technical issue lies in the failure to correctly evaluate directory paths against predefined blocklists or permission scopes during tree-based URI grant operations. When an application requests access to external storage via SAF (Storage Access Framework), the provider is responsible for validating whether the requested path falls within allowed boundaries. In this specific instance, the validation logic fails to properly restrict access to directories that should be inaccessible based on current security policies, effectively creating a bypass in the sandbox enforcement layer.
This flaw allows an attacker with local application execution privileges to escalate their rights by accessing protected data without requiring additional permissions or user interaction. The absence of required user interaction significantly lowers the barrier for exploitation, as malicious applications can silently probe and extract sensitive information from directories that are typically reserved for system use or other privileged apps. This scenario aligns closely with CWE-284 Improper Access Control, specifically where access control decisions are made incorrectly due to flawed logic rather than missing checks. Furthermore, this behavior facilitates unauthorized data exfiltration, which maps directly to the ATT&CK technique T1005 Data from Local System, as it enables an adversary to gather sensitive information stored on the device without triggering standard security alerts or requiring explicit user consent for each access event.
The operational impact of such a vulnerability is severe, particularly in enterprise environments where data loss prevention (DLP) policies rely on strict adherence to storage isolation boundaries. An attacker could potentially read configuration files, cached credentials, or private documents belonging to other applications that assume their data remains isolated from external storage providers. This breach of confidentiality compromises the integrity of the device's security model and may lead to further lateral movement if sensitive keys or tokens are exposed. The lack of user interaction means that background processes can exploit this flaw continuously, making detection difficult for standard monitoring tools unless specific file access patterns are tracked at a deeper system level.
Mitigation strategies must focus on patching the underlying logic error in ExternalStorageProvider.java to ensure rigorous path validation and scope enforcement. Developers should implement strict canonicalization of directory paths before evaluation to prevent traversal attacks or ambiguous path resolutions that might bypass blocklists. Additionally, enforcing least-privilege principles by restricting tree-based URI grants to only explicitly whitelisted directories can reduce the attack surface. For system integrators, applying security patches from the vendor is paramount, as this issue resides in core framework components. Users should maintain up-to-date operating systems and avoid installing applications from untrusted sources that might attempt to exploit such storage provider flaws for data theft or privilege escalation purposes.