CVE-2026-28599: Android Intent Redirection Privilege Escalation

CVE-2026-28599 Overview

CVE-2026-28599 is an Intent Redirection Bypass vulnerability in the Android ActivityManagerService.java component. The flaw resides in the addCreatorToken method, where a logic error allows attackers to bypass intent redirection protections. A local attacker with low privileges can exploit this issue to escalate privileges on the affected device without user interaction.

The vulnerability is tracked under [CWE-693: Protection Mechanism Failure], indicating that a security control designed to prevent intent misuse fails to enforce its intended constraints. Android disclosed the issue in the Android Security Bulletin September 2026.

Critical Impact
A local application without special permissions can escalate privileges by forging or redirecting intents through the addCreatorToken logic flaw, achieving unauthorized access to protected components.

Affected Products

Android Open Source Project (AOSP) — ActivityManagerService component
Android devices consuming the September 2026 security patch level
Downstream Android distributions incorporating the affected framework code

Discovery Timeline

2026-09-08 - CVE-2026-28599 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28599

Vulnerability Analysis

The vulnerability exists in the addCreatorToken method of ActivityManagerService.java, a core Android framework class that manages activity lifecycle and inter-process communication. Android uses creator tokens to attribute intent origins, enabling the platform to enforce intent redirection defenses introduced to mitigate confused-deputy attacks.

A logic error in the token assignment path allows a local application to bypass the intent redirection protection mechanism. By crafting intents that manipulate the token flow, a low-privileged app can cause the system to treat forwarded intents as originating from a more privileged component. This produces a local escalation of privilege without requiring additional execution privileges or user interaction.

The issue is classified under [CWE-693: Protection Mechanism Failure] because the intent redirection safeguard fails rather than an underlying access control being absent.

Root Cause

The root cause is a flawed control-flow decision within addCreatorToken that mis-assigns or omits creator tokens under specific conditions. When the check that gates token propagation is bypassed, the system loses the ability to distinguish legitimate intent originators from attacker-controlled callers. This breaks the trust boundary that intent redirection mitigations depend on.

Attack Vector

Exploitation requires local access through an installed application with normal user-level privileges. The malicious app constructs an intent sequence that triggers the flawed token logic, then routes the intent to a privileged system component. Because user interaction is not required, exploitation can occur silently in the background once the malicious application runs.

No public proof-of-concept code is available. See the Android Security Bulletin September 2026 for vendor-supplied technical details and patch references.

Detection Methods for CVE-2026-28599

Indicators of Compromise

Unexpected launches of privileged system activities initiated by third-party application UIDs
Anomalous PendingIntent or intent forwarding patterns originating from unprivileged packages
Applications requesting access to components normally reserved for system or signature-level callers

Detection Strategies

Audit installed applications for use of reflective intent construction or manipulation of ActivityOptions fields tied to creator tokens
Monitor Android system logs (logcat) for ActivityManagerService warnings related to intent creator attribution or token mismatches
Correlate privilege-sensitive activity launches with the originating package UID to identify redirection anomalies

Monitoring Recommendations

Deploy mobile threat defense tooling that inspects application behavior at runtime for intent redirection abuse
Ingest device telemetry into a centralized data lake to baseline normal intent flows and flag deviations
Track the September 2026 Android security patch level across the managed device fleet to identify unpatched endpoints

How to Mitigate CVE-2026-28599

Immediate Actions Required

Apply the September 2026 Android security patch level (2026-09-01 or later) to all managed devices
Enforce enterprise mobility management policies that block installation of untrusted or sideloaded applications
Restrict installation sources to vetted app stores and require application reputation checks before deployment

Patch Information

Google addressed the vulnerability in the September 2026 Android Security Bulletin. Device manufacturers must integrate the framework patch and ship an update that reports the 2026-09-01 security patch level or later. Refer to the Android Security Bulletin September 2026 for the source patch references and affected version matrix.

Workarounds

No official workaround replaces the framework patch; prioritize OS updates from the device OEM
Limit exposure by removing unnecessary third-party applications from high-value devices until patched
Segment sensitive workloads onto devices that have received the September 2026 or later security patch level

bash

# Verify the security patch level on an Android device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-09-01 or later