CVE-2026-28573 Details
Description
In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
A denial-of-service vulnerability has been identified in the Framework component of Android Wear OS. This issue arises from a missing permission check in the AndroidManifest.xml, which can lead to a persistent local denial-of-service condition. The vulnerability does not require any additional execution privileges or user interaction for exploitation.
To address this vulnerability, users should update their devices to the June 2026 security patch level. Instructions for checking and installing security updates are available on the Google device update schedule page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://source.android.com/docs/security/bulletin/wear/2026/2026-06-01 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| google android | 14.0 16.0 - |
CPE
Remediation
| |
| samsung wear os | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | Initial Analysis | [email protected] |
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |