CVE-2026-28602 Overview
CVE-2026-28602 is a local privilege escalation vulnerability in the Android ClipboardService.java component. The flaw resides in the setClipboardAccessNotificationsEnabledForUser method, where a logic error breaks multi-user isolation boundaries. A local attacker with low privileges can exploit this weakness without user interaction to gain elevated access across user profiles on the device. The issue is classified under [CWE-284] Improper Access Control and was published in the Android Security Bulletin for September 2026.
Critical Impact
Local attackers can bypass Android's multi-user isolation model to escalate privileges, compromising confidentiality, integrity, and availability of data belonging to other users on the same device.
Affected Products
- Android Open Source Project (AOSP) — ClipboardService component
- Android devices running vulnerable versions as identified in the September 2026 bulletin
- OEM Android builds that inherit the affected AOSP code
Discovery Timeline
- 2026-09-08 - CVE-2026-28602 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28602
Vulnerability Analysis
The vulnerability affects the setClipboardAccessNotificationsEnabledForUser method inside ClipboardService.java. Android's ClipboardService manages clipboard content and access notifications across user profiles on multi-user devices. A logic error in this method fails to correctly enforce isolation between users, allowing a local application running as one user to influence clipboard notification state for another user context.
The result is a local escalation of privilege. An attacker requires only local access and low privileges to trigger the flaw, and no user interaction is needed. Successful exploitation impacts all three security properties — confidentiality, integrity, and availability — because clipboard state manipulation can expose sensitive data and disrupt user workflows across profiles.
Root Cause
The root cause is a logic error in the access control checks within setClipboardAccessNotificationsEnabledForUser. The method does not correctly validate that the calling context has authority over the target user identifier. This mirrors classic [CWE-284] Improper Access Control patterns, where a callable API accepts a user parameter without verifying the caller's permission to act on that user.
Attack Vector
Exploitation requires a malicious or compromised application installed on the device. The attacker invokes the vulnerable clipboard service API with a user identifier belonging to a different profile. Because the service does not enforce cross-user permission checks properly, the call succeeds and yields privileged effects outside the caller's user boundary. No physical access, network access, or user interaction is required beyond initial application installation.
No public proof-of-concept exploit is available at the time of publication. Technical details are documented in the Android Security Bulletin September 2026.
Detection Methods for CVE-2026-28602
Indicators of Compromise
- Installed applications that request or invoke clipboard-related system APIs without a clear functional need.
- Anomalous cross-user clipboard notification state changes recorded in system logs.
- Applications targeting internal ClipboardService methods through reflection or hidden API access.
Detection Strategies
- Review installed application inventories for untrusted or sideloaded packages on multi-user or work-profile devices.
- Inspect Android system logs (logcat) for unexpected calls related to setClipboardAccessNotificationsEnabledForUser.
- Use mobile threat defense telemetry to flag applications abusing hidden or reflective API access to system services.
Monitoring Recommendations
- Track Android patch level across the managed fleet and alert on devices reporting a security patch level earlier than September 2026.
- Monitor enterprise mobility management (EMM) compliance reports for devices that fall out of patch compliance.
- Correlate application install events with subsequent privilege-escalation indicators using centralized logging.
How to Mitigate CVE-2026-28602
Immediate Actions Required
- Apply the September 2026 Android security patch level to all affected devices as soon as OEM builds are available.
- Enforce EMM policies that block installation of applications from untrusted sources on multi-user and work-profile devices.
- Audit installed applications on shared or multi-user devices and remove any that are unnecessary or untrusted.
Patch Information
Google addressed CVE-2026-28602 in the September 2026 Android Security Bulletin. Device owners should install updates that report a security patch level of 2026-09-01 or later. Refer to the Android Security Bulletin September 2026 for the authoritative fix reference and affected component information.
Workarounds
- Avoid provisioning multiple user profiles or work profiles on devices that cannot be updated to the September 2026 patch level.
- Restrict application installation to vetted enterprise app catalogs until patches are deployed.
- Disable or remove non-essential applications on shared devices to reduce local attack surface.
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
