CVE-2026-28662Patch(google / android)

LOWCVSS 8.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch google android systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

google CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://source.android.com/docs/security/bulletin/2026/2026-09-01

Weakness type (CWE)

CWE-122CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

android

Threat summary

Patch or workaround signal is available
6 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 5 signals
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 4d ago at 2 mentions (2026-09-09); latest day: 1
6 total mentions across 5 days

Affected systems

Vendors

google

Products

android

2 versions affected across 1 product

Deep dive

Activity timeline6 mentions / 5d

Signal classification3 categories

Patch

466.7%

General

116.7%

Disclosure

116.7%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-09	2	General1Patch1
2026-09-10	1	Patch1
2026-09-11	1	Patch1
2026-09-12	1	Disclosure1
2026-09-15	1	Patch1

Full discourse6 posts

Alex Rad@defendtheworld46d
General
CVE-2026-28662 from https://source.android.com/docs/security/bulletin/2026/2026-09-01 looks like it could be a patch gap for https://git.w1.fi/cgit/hostap/commit/?id=af2886cbabca3246ba8b4c40d2813c36cde35f86 with wifi direct.
Post summary
The tweet cites CVE‑2026‑28662 from the Android security bulletin and suggests a potential patch gap related to Wi‑Fi Direct in a hostap commit, but it lacks technical details, exploit evidence, or patch information.
100761.1K
2.3K followersView on X
Ryx@PadhiyarRushi40d
Patch
Android’s September 2026 security update fixed 180 issues. The one that stands out is CVE-2026-28662: Wi-Fi related memory corruption that can lead to remote code execution with no user interaction and no additional privileges. Still the class of bug that turns a nearby attacker into a device owner if the patch lag is long enough. https://www.securityweek.com/androids-september-2026-updates-patch-180-vulnerabilities/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #MobileSecurity #RCE
Post summary
The text announces Android's September 2026 security patch fixing CVE-2026-28662, a Wi-Fi memory corruption vulnerability enabling remote code execution without user interaction, emphasizing the risk of patch lag.
00021178
953 followersView on X
كاسبر سكاي@KasperskyDev44d
Disclosure
جوجل تُصلح 180 ثغرة في أندرويد أبرزها ثغرة واي فاي تتيح تنفيذ كود عن بُعد. المعرّف : CVE-2026-28662 درجة الخطورة : Critical - Wi-Fi RCE الإصدارات المتأثرة : Android 14 / 15 / 16 / 17 الحل : Patch to 2026-09-05 level #Android #CVE202628662
Post summary
Google has released a critical Wi‑Fi remote code execution fix for Android 14‑17, with a patch to level 2026‑09‑05, announcing the vulnerability CVE‑2026‑28662.
01001212
39.9K followersView on X
Swif@swif_ai44d
Patch
Android's Sept bulletin splits into two patch levels: 09-01 fixes a no-interaction critical RCE, 09-05 adds a Wi-Fi RCE flaw (CVE-2026-28662). MDM policy should require the 09-05 minimum. https://www.securityweek.com/androids-september-2026-updates-patch-180-vulnerabilities/
Post summary
Android September 2026 bulletin lists two patch levels; CVE‑2026‑28662 is a Wi‑Fi RCE and the text advises applying patch 09‑05 as part of MDM policy.
0000040
61 followersView on X
The Daily Tech Feed@dailytechonx45d
Patch
Huge security roundup: Google patches 200 Android vulnerabilities—in particular a Wi-Fi bug (CVE-2026-28662) that enables remote code execution. Meanwhile, phishing campaigns leverage browser redirects & fake shops clone real brands at scale. Exposure through extensions, Shadow AI risk, Patel servers still wide open. Stay alert & update fast. #Cybersecurity #Android #Phishing #ShadowAI #Vulnerabilities #Trust https://thedailytechfeed.com/google-patches-200-android-vulnerabilities-including-critical-wi-fi-bug/
Post summary
Google has patched a critical Wi‑Fi bug (CVE‑2026‑28662) that allows remote code execution as part of a 200‑vulnerability update, underscoring the need to apply patches promptly.
0000067
723 followersView on X
Cybersecurity News Everyday@TweetThreatNews46d
Patch
Google's September 2026 Android security updates fix 180 vulnerabilities, including critical System flaws and CVE-2026-28662, a Wi-Fi memory corruption bug that could enable remote code execution. #Android #Google #CVE202628662 https://www.hendryadrian.com/androids-september-2026-updates-patch-180-vulnerabilities/
Post summary
Google’s September 2026 Android security update includes a patch for CVE-2026‑28662, a Wi‑Fi memory corruption bug capable of remote code execution, among 180 other fixes.
00000220
4.7K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	google	android	16.0	-	-
OS	google	android	16.0	-	-
OS	google	android	17.0	-	-

Explore more

Back to dashboard google CVEs android vulnerabilities

What researchers are saying

CVE-2026-28662

Alex Rad[verified]@defendtheworldGeneral

The tweet cites CVE‑2026‑28662 from the Android security bulletin and suggests a potential patch gap related to Wi‑Fi Direct in a hostap commit, but it lacks technical details, exploit evidence, or patch information.

Ryx[verified]@PadhiyarRushiPatch

The text announces Android's September 2026 security patch fixing CVE-2026-28662, a Wi-Fi memory corruption vulnerability enabling remote code execution without user interaction, emphasizing the risk of patch lag.

The Daily Tech Feed[verified]@dailytechonxPatch

Google has patched a critical Wi‑Fi bug (CVE‑2026‑28662) that allows remote code execution as part of a 200‑vulnerability update, underscoring the need to apply patches promptly.

Cybersecurity News Everyday[verified]@TweetThreatNewsPatch

Google’s September 2026 Android security update includes a patch for CVE-2026‑28662, a Wi‑Fi memory corruption bug capable of remote code execution, among 180 other fixes.

كاسبر سكاي@KasperskyDevDisclosure

Google has released a critical Wi‑Fi remote code execution fix for Android 14‑17, with a patch to level 2026‑09‑05, announcing the vulnerability CVE‑2026‑28662.

Swif@swif_aiPatch

Android September 2026 bulletin lists two patch levels; CVE‑2026‑28662 is a Wi‑Fi RCE and the text advises applying patch 09‑05 as part of MDM policy.