The issue is assigned CVE-2026-58882, has Critical severity and is part of the November 2026 security patch level. OEMs received the patch in July 2026 and have been allowed to ship it since then. That's how the patch system now works for Android. GrapheneOS has access to the security preview patches so we got it patched for our users in July 2026.

Android's public issue tracker isn't the real issue tracker. They create internal issues for what's reported there. That means the discussion about it doesn't happen there. Security bug reports are mainly treated as a request for a bounty and little communication happens beyond what's related to receiving a bounty for it. If someone else filed it then it gets closed and no further info is provided. If someone external filed the first report, they hardly get any updates themselves beyond eventually being informed which Android Security Bulletin included it months after it was disclosed to OEMs and allowed to be patched.