Skip to content
Sign in
10.0 Critical

CVE-2026-28659 In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check

Description

In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products and versions

Product Affected versions Fixed in
Android XR 14 No fix stated

Other CVEs of Android XR

The 3 CVEs of Android XR →
CVE-2026-58873 In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission… 8.4 High CVE-2026-0072 In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission… 10.0 Critical
Track this CVE