Hacker News
points by mrb 11 hours ago | 0 comments
As an ex-Google ISE, part of my work was to review security vulnerability reports to us. If this report came on my lap I would definitely have flagged this as a severe security issue. Just a DoS yes, but a severe DoS. I did tier two engineering reviews though. From the website's timeline it seems like a tier one triager dismissed it. And I would see this happen occasionally: tier one triagers either dismissing things that shouldn't, or the reverse, flagging things that don't deserve it. My personal opinion is that the quality of Google's work has declined somewhat in the last decade. Disappointing...
[–] grapheneos 4 hours ago
Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a patch was pushed to AOSP in October:

https://android.googlesource.com/platform/frameworks/opt/tel...

It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:

https://grapheneos.org/releases#2026072900

Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.

[–] MarkBlah 9 hours ago
triage seems outsourced for android, messages like "we will forward this to the android team". This seems to have been a communication issue, they set it as Will Not Fix, they 'fixed' the bug by adding try/catches further up the chain in upcoming release, i missed that before i submitted.

they did set it as a duplicate of a ticket they disregarded.

I found the Chrome team the easiest to communicate with, devs would actually respond.

page updated to reflect.

[–] grapheneos 3 hours ago
The issue is assigned CVE-2026-58882, has Critical severity and is part of the November 2026 security patch level. OEMs received the patch in July 2026 and have been allowed to ship it since then. That's how the patch system now works for Android. GrapheneOS has access to the security preview patches so we got it patched for our users in July 2026.

Android's public issue tracker isn't the real issue tracker. They create internal issues for what's reported there. That means the discussion about it doesn't happen there. Security bug reports are mainly treated as a request for a bounty and little communication happens beyond what's related to receiving a bounty for it. If someone else filed it then it gets closed and no further info is provided. If someone external filed the first report, they hardly get any updates themselves beyond eventually being informed which Android Security Bulletin included it months after it was disclosed to OEMs and allowed to be patched.

[–] mrb 8 hours ago
Sorry you went through that! It must be frustrating.