CVE-2026-28659 is a missing permission check in MicroXR Blobstore on Google Android XR. The record scores it 7.8 (High) and says it could let a local app access another app's files and escalate privilege. Google's September 2026 Android XR bulletin lists the fix at the 2026-09-01 security patch level.
What's affected
Google's Android XR security bulletin for September 2026 lists CVE-2026-28659 as a High severity elevation of privilege issue in the System component, affecting AOSP version 14, with the fix at the 2026-09-01 patch level. The bulletin says XR updates also need the 2026-09-05 or later patch level from the September 2026 Android Security Bulletin. It was published on 8 September 2026.
Source conflict to note: the CVE record names the component MicroXR Blobstore and describes a missing permission check. The Google bulletin lists the component as System and gives a short, incomplete description, so the component name could not be confirmed from the bulletin. Both are reported here.
Weakness class: CWE-269, improper privilege management. Firmware images should come from your device supplier.
How to check if you're exposed
On an Android XR headset, open Settings, find About, and read the Android security patch level. You are looking for 2026-09-01 or later, and per Google's note, 2026-09-05 or later for the full XR set. If the device is managed, your MDM should report the patch level.
The device maker controls when updates arrive, so check with the supplier if the update is not offered. Headsets that sit in drawers between uses often miss several months of updates, so include them in your inventory.
What to do now
- Update Android XR devices to the 2026-09-01 patch level, and to 2026-09-05 or later where the bulletin requires it.
- Ask your device supplier for the firmware images if the update is not offered over the air.
- Limit installed apps on shared or demonstration headsets to those you approve.
- Add XR headsets to the same patch compliance reporting as phones and tablets.
- Re-read Google's bulletin when it is revised, because the entry text was incomplete when we read it.
Why it matters
A missing permission check means a service hands out something, here other apps' files in a shared blob store, without verifying that the caller has the right to it. The record rates confidentiality, integrity and availability impact as high, with a local vector, low privileges and no user interaction.
On a headset, apps may handle camera frames, spatial maps and room data. Isolation between apps is what keeps one compromised or careless app from reading the others. The KEV flag is false and Google's bulletin does not report exploitation. Google also notes the High rating assumes platform and service mitigations are disabled or bypassed.
Quick check
Does this affect regular Android phones?
The Google bulletin we read is the Android XR bulletin and lists AOSP version 14. Check the main Android bulletin for phones.
Why does the component name differ?
The record says MicroXR Blobstore and Google's entry says System. We report both and could not reconcile them.
Sources
Last reviewed: 18 October 2026.
