[1day-1line] CVE-2026-28666: Exposure of Untrusted RAW Decoders in SystemUI via a mimetype Check Bypass in Android LocalImageResolver Hello, this is Libera. Today's 1day-1line covers a check bypass in Android's notification image path. Google added a mimetype allowlist to LocalImageResolver to keep the bug-prone RAW decoders out of the notification path, but the check was wired into only 1 of its 7 call sites. As a result, an attacker app can run the blocked DNG decoder inside the SystemUI process with a single setLargeIcon() call. Depending on the decoded content, this can lead to a Persistent DoS or EOP. Please refer to the blog post for more details (Root Cause, PoC, and Patch info)! https://hackyboiz.github.io/2026/09/16/Libera/CVE-2026-28666/
Post summary
The post discloses an Android LocalImageResolver mimetype check bypass that allows a local app to invoke the DNG decoder in SystemUI, with a link to a blog containing root cause, PoC, and patch information.