CVE-2026-28572 Overview
CVE-2026-28572 is a local privilege escalation vulnerability in the Android InstallLaunch.kt component. The flaw resides in the onCreate method and enables a tapjacking or overlay attack against the installation UI. An attacker with local access can display a deceptive overlay on top of the installer, tricking users into approving unintended actions. Exploitation requires no additional execution privileges. The vulnerability is classified under [CWE-601] URL Redirection to Untrusted Site and is addressed in the Android Security Bulletin for September 2026.
Critical Impact
Successful exploitation grants local escalation of privilege by manipulating installer UI decisions through a misleading overlay.
Affected Products
- Android operating system (installer component InstallLaunch.kt)
- Devices receiving the September 2026 Android Security Bulletin patches
- Refer to the Android Security Bulletin September 2026 for the complete list of affected versions
Discovery Timeline
- 2026-09-08 - CVE-2026-28572 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28572
Vulnerability Analysis
The vulnerability exists in the onCreate method of InstallLaunch.kt, the Android component responsible for handling application install intents. The installer activity does not adequately defend against overlay windows drawn by other applications. A malicious app can present UI elements above the installer, obscuring the true content the user is approving. This class of issue is commonly called tapjacking, where user taps intended for one interface are captured by another. The result is that a user believes they are interacting with a benign dialog while actually authorizing installation or permission grants controlled by the attacker.
Root Cause
The root cause is the absence of touch-filtering protections on the installer activity. Android provides setFilterTouchesWhenObscured and the filterTouchesWhenObscured XML attribute to discard touch events when the view is covered by another window. When these protections are not applied to sensitive install confirmation dialogs, a translucent or partial overlay from another app can mislead the user about what action they are approving.
Attack Vector
Exploitation requires a locally installed malicious application with the ability to draw overlays, typically granted through the SYSTEM_ALERT_WINDOW permission or through accessibility abuse. The attacker triggers the installer activity, then draws deceptive UI on top of it. The user, believing they are dismissing an unrelated notification or completing a benign task, taps through and authorizes the underlying installer action. No additional execution privileges are required, and the interaction can be engineered so the user is unaware of the true consent being granted.
No public exploit code is available for this vulnerability. See the Android Security Bulletin September 2026 for additional technical detail.
Detection Methods for CVE-2026-28572
Indicators of Compromise
- Installation of applications that were not initiated through recognized user workflows or enterprise MDM channels
- Presence of third-party apps holding the SYSTEM_ALERT_WINDOW permission or bound accessibility services without clear justification
- Unexpected package installer activity in logcat correlated with foreground overlay windows from unrelated apps
Detection Strategies
- Inventory applications requesting overlay or accessibility permissions and flag those with low reputation or unclear purpose
- Monitor mobile device management telemetry for install events sourced from unknown installers rather than the official app store
- Correlate package installer launches with concurrent overlay window activity to identify potential tapjacking sequences
Monitoring Recommendations
- Enable mobile threat defense telemetry to record overlay permission grants and installer activity
- Alert on newly installed packages that originate from sideloaded sources on managed devices
- Review Android security logs after each monthly security bulletin release to validate patch adoption across the fleet
How to Mitigate CVE-2026-28572
Immediate Actions Required
- Apply the September 2026 Android security patch level or later to all affected devices
- Audit installed applications for those holding the SYSTEM_ALERT_WINDOW permission and revoke where not required
- Restrict sideloading on managed devices through mobile device management policy
Patch Information
Google addressed the vulnerability in the September 2026 Android Security Bulletin. Device manufacturers deliver the fix through the monthly security patch level. Administrators should confirm devices report a patch level of 2026-09-01 or later. Consult the Android Security Bulletin September 2026 for source patch references and affected version details.
Workarounds
- Disable installation from unknown sources across the device fleet using enterprise policy
- Deny the overlay permission for all non-essential applications on managed devices
- Educate users to dismiss unexpected install prompts and to reject overlay permission requests from untrusted apps
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.