CVE-2026-28582 Overview
CVE-2026-28582 is a missing authorization vulnerability in the Android platform. The flaw resides in the onCreate method of ConfirmDeviceCredentialActivity.java, where a required permission check is absent. A local attacker can leverage this gap to gain unauthorized access to and modify device credentials. Exploitation requires no user interaction and no additional execution privileges beyond low-privileged local access. The vulnerability is classified under [CWE-862] Missing Authorization and results in local information disclosure.
Critical Impact
Local attackers can access and modify device credentials without user interaction, undermining the device credential confirmation flow used to gate sensitive operations.
Affected Products
- Android platform (see Android Security Bulletin September 2026 for affected versions)
- Components implementing ConfirmDeviceCredentialActivity
- Devices pending the 2026-09-01 security patch level
Discovery Timeline
- 2026-09-08 - CVE-2026-28582 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28582
Vulnerability Analysis
The vulnerability exists in ConfirmDeviceCredentialActivity.java, an Android system activity responsible for prompting users to confirm their device credentials such as PIN, pattern, or password. This activity gates access to sensitive workflows, including credential changes and secure application access.
The onCreate method fails to enforce a required permission check before processing incoming intents. As a result, callers without the appropriate authorization can invoke functionality that should be restricted to trusted system components. The confidentiality impact is limited to local information disclosure, and no additional execution privileges are gained.
Root Cause
The root cause is a missing authorization check (CWE-862) in the activity's entry point. Android activities that expose privileged operations must validate the calling package's permissions or verify the caller identity using mechanisms such as checkCallingPermission or Binder.getCallingUid. The absence of this validation in onCreate allows any local application to trigger the credential confirmation flow with attacker-controlled parameters.
Attack Vector
Exploitation requires local access with low privileges, typically achieved by installing a malicious application on the target device. The attacker crafts an intent targeting ConfirmDeviceCredentialActivity and delivers it through standard Android intent APIs. Because no user interaction is required, the attack can execute silently in the background. The scope is unchanged, and the primary outcome is disclosure of credential-related information.
No verified proof-of-concept code is publicly available. For technical details, refer to the Android Security Bulletin September 2026.
Detection Methods for CVE-2026-28582
Indicators of Compromise
- Unexpected invocations of ConfirmDeviceCredentialActivity originating from non-system packages
- Installed applications requesting access to keyguard or credential confirmation intents without a legitimate use case
- Anomalous credential change events not initiated by the user through Settings
Detection Strategies
- Monitor Android logcat for activity launches targeting com.android.settings.ConfirmDeviceCredentialActivity from untrusted UIDs
- Inspect installed applications for manifest declarations that reference internal keyguard components
- Correlate credential modification events with the initiating process to identify unauthorized callers
Monitoring Recommendations
- Enroll devices in a mobile threat defense solution that tracks intent-based abuse of system activities
- Alert on installations of applications from untrusted sources on devices below the 2026-09-01 patch level
- Baseline normal credential confirmation workflows and flag deviations in enterprise mobility management telemetry
How to Mitigate CVE-2026-28582
Immediate Actions Required
- Apply the Android security patch level 2026-09-01 or later on all managed devices
- Restrict installation of applications from unknown sources through mobile device management policies
- Audit installed applications and remove any that request unnecessary access to keyguard or credential components
Patch Information
Google addressed this vulnerability in the Android Security Bulletin dated 2026-09-01. Device manufacturers deliver the fix through vendor-specific over-the-air updates. Administrators should consult the Android Security Bulletin September 2026 for the complete list of affected components and patch identifiers.
Workarounds
- Enforce work profile separation to limit exposure of personal credentials on managed devices
- Require attestation of the Android security patch level before granting access to corporate resources
- Disable sideloading and enable Google Play Protect to reduce the likelihood of malicious application installation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
