CVE-2026-28600 Overview
CVE-2026-28600 is a local privilege escalation vulnerability in the Android PaymentDefaultDialog.java component. The flaw resides in the onCreate method and stems from a confused deputy condition that allows an unauthorized caller to change the default payment application. Exploitation requires no additional execution privileges and no user interaction. An attacker with local access can leverage the higher-privileged dialog component to perform an action the caller could not perform directly. The issue is tracked under [CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')] and is addressed in the Android Security Bulletin September 2026.
Critical Impact
A local application can silently change the device's default payment application, redirecting tap-to-pay transactions to an attacker-controlled handler.
Affected Products
- Android Open Source Project (AOSP) — PaymentDefaultDialog component
- Android platform builds prior to the September 2026 security patch level
- Original equipment manufacturer (OEM) devices shipping the vulnerable NFC payment subsystem
Discovery Timeline
- 2026-09-08 - CVE-2026-28600 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28600
Vulnerability Analysis
The vulnerability exists in PaymentDefaultDialog.java, a system-level dialog responsible for prompting the user before switching the default tap-and-pay application on Android. When the onCreate method processes an incoming intent, it acts on data supplied by the caller without adequately verifying that the caller has the authority to request the change. Because the dialog itself runs with privileges to modify the default payment handler, a low-privileged local application can trick it into performing the switch on the caller's behalf. This is the classic confused deputy pattern captured by [CWE-441]. The result is a local escalation of privilege that impacts the confidentiality, integrity, and availability of the device's payment configuration.
Root Cause
The root cause is missing or insufficient validation of the caller identity and intent parameters within onCreate. The privileged component trusts request data that should be treated as attacker-controlled, allowing a proxy operation to complete without user confirmation.
Attack Vector
Exploitation requires local access through an installed application. The malicious app crafts an intent targeting the vulnerable dialog and causes PaymentDefaultDialog to update the default payment service. No user interaction and no additional runtime permissions are required, which allows the change to occur silently and enables downstream attacks against near-field communication (NFC) payment flows.
The vulnerability is described in prose only; no verified proof-of-concept code has been released. Refer to the Android Security Bulletin September 2026 for the vendor's technical description.
Detection Methods for CVE-2026-28600
Indicators of Compromise
- Unexpected changes to the default NFC payment application recorded in PackageManager or CardEmulation state.
- Recently installed third-party applications that register HostApduService components without a legitimate business reason.
- Logcat entries from PaymentDefaultDialog showing onCreate invocations initiated by non-system UIDs.
Detection Strategies
- Audit installed applications for those declaring android.nfc.cardemulation.action.HOST_APDU_SERVICE and cross-reference against approved payment providers.
- Compare the current default payment application against a known-good baseline for managed devices.
- Review mobile device management (MDM) telemetry for intent activity targeting com.android.settings payment components from non-system callers.
Monitoring Recommendations
- Enable enterprise mobility management (EMM) alerts on changes to NFC payment defaults on corporate devices.
- Ingest Android device logs into a centralized security analytics platform and alert on abnormal PaymentDefaultDialog activity.
- Track Android security patch level compliance across the mobile fleet and flag devices below the September 2026 patch level.
How to Mitigate CVE-2026-28600
Immediate Actions Required
- Apply the Android September 2026 security patch level or later to all managed devices.
- Inventory devices that cannot receive the patch and restrict their use for tap-to-pay transactions.
- Remove untrusted applications that declare NFC host card emulation services.
Patch Information
The fix is delivered through the AOSP monthly security update referenced in the Android Security Bulletin September 2026. Verify that affected devices report a security patch level of 2026-09-01 or later. OEM delivery timelines vary; confirm rollout status with each device vendor.
Workarounds
- Restrict installation of unvetted applications through managed Google Play or an equivalent enterprise app store.
- Disable NFC on devices that do not require tap-to-pay functionality until the patch is applied.
- Use MDM policy to prevent users from installing applications that register host-based card emulation services.
# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Enumerate applications registered as NFC payment services
adb shell cmd card_emulation list-services 0 payment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
