Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a patch was pushed to AOSP in October:

https://android.googlesource.com/platform/frameworks/opt/tel...

It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:

https://grapheneos.org/releases#2026072900

Google mishandled the issue report. There was likely an internal miscommunication and they handled the report incorrectly. It's possible the issue was already filed internally and they meant to close it as a duplicate instead of WONTFIX. Closing it at all may have been an error.