← Back to Vulnerability Reports CVE Intelligence

CVE-2026-28662

Google Android•HIGH · CVSS 8•No exploitation reported

What is CVE-2026-28662?

In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS8 NVD 3.1

SeverityHIGH

ExploitationNo exploitation reported

EPSS<1% · P6

Triage statusNo Known Exploit

ActionPatch this week

CVSS vectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWECWE-122

NVD published2026-09-08

NVD last modified2026-09-15

Timeline

2026-09-08Published to the U.S. National Vulnerability Database (NVD)
2026-09-10First covered in a defend.network daily briefing
2026-09-15NVD record last updated

Affected product

Google Android

References

Referenced in our briefings & reports

Cisco FMC actively exploited; BlueMoon exploit kit chains Chrome & Windows; AI tokens bypass MFA (2026-09-10)

Related vulnerabilities

CVE-2026-58704 – Google Pixel (same product)
CVE-2025-48595 – Android Framework (same product)
CVE-2026-111497 – Google Brotli (same vendor)
CVE-2026-87491 – Google Chromium V8 (same vendor)
CVE-2026-85046 – Google Chromium V8 (same vendor)
CVE-2026-11645 – Google Chromium V8 (same vendor)

Google: 76 known exploited vulnerabilities (CISA KEV) →

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.