CVE-2026-28645
Medium · 6.8CVSS
6.8
EPSS
0.1%
Published
Nov 2, 2026
CISA due date
—
The record
In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-93325 Buildx bake requires the user to grant entitlements with --allow or an interactive prompt… CWE-693
- CVE-2026-44267 Elo is a purely functional expression language for no-code tools. CWE-693
- CVE-2026-59031 In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of… CWE-693
- CVE-2026-58978 In multiple locations, there is a possible permission bypass due to a logic error in the… CWE-693
- CVE-2026-58979 In canPresent of PresentationController.java, there is a possible permission bypass due… CWE-693
- CVE-2026-58956 In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a… CWE-693
- CVE-2026-58946 In navigateUpTo of ActivityClientController.java, there is a possible permission bypass… CWE-693
- CVE-2026-58934 In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible… CWE-693