CVE-2026-28603: Android AppRestrictionsFragment Privilege Escalation

CVE-2026-28603 Overview

CVE-2026-28603 is a local privilege escalation vulnerability in the Android platform. The flaw resides in the assertSafeToStartCustomActivity method of AppRestrictionsFragment.java. A confused deputy condition allows an attacker to obtain read and write access to private files belonging to other applications or the system. Exploitation requires no user interaction and no additional execution privileges beyond those of a local, low-privileged app. The issue is tracked under CWE-441: Unintended Proxy or Intermediary and is addressed in the Android Security Bulletin September 2026.

Critical Impact
A local application can escalate privileges and access private files of other apps or the system without user interaction.

Affected Products

Android Open Source Project (AOSP) AppRestrictionsFragment component
Android device builds incorporating the vulnerable Settings component
Refer to the Android Security Bulletin September 2026 for specific patch levels

Discovery Timeline

2026-09-08 - CVE-2026-28603 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28603

Vulnerability Analysis

The vulnerability sits inside the assertSafeToStartCustomActivity routine of AppRestrictionsFragment.java, part of the Android Settings user restrictions workflow. This routine is intended to validate that a custom activity supplied by a caller is safe for the Settings process to launch on the caller's behalf. The validation is incomplete, which produces a confused deputy condition. A malicious app can pass a crafted Intent that the privileged Settings process then dispatches, granting the app indirect access to resources it could not open on its own. The result is unauthorized read and write access to private files. The classification aligns with CWE-441: Unintended Proxy or Intermediary.

Root Cause

The root cause is insufficient verification of the target activity and its associated data URIs before Settings starts the activity. Because Settings runs with elevated capabilities, it can grant URI permissions or open content the calling app cannot reach directly. When assertSafeToStartCustomActivity fails to constrain the caller-controlled Intent, the privileged process performs the operation on behalf of an untrusted requester.

Attack Vector

Exploitation is local. A malicious application installed on the device crafts an Intent that references restricted content and triggers the Settings-mediated flow that invokes AppRestrictionsFragment. The Settings process then acts as a proxy, exposing private files or granting URI permissions that the calling app would otherwise be denied. No user interaction is required, and the attacker only needs the ability to execute an app on the device.

No public exploit code is available for this issue. Refer to the Android Security Bulletin September 2026 for authoritative technical details.

Detection Methods for CVE-2026-28603

Indicators of Compromise

Unexpected access to private application directories under /data/data/<package>/ originating from Settings-mediated activity launches
Anomalous Intent traffic targeting AppRestrictionsFragment from non-system packages
Grants of content URI permissions to unprivileged apps without a corresponding user action

Detection Strategies

Audit device logs (logcat) for activity start events routed through AppRestrictionsFragment where the calling UID is a third-party app
Correlate Settings process activity launches with subsequent file access in another app's private data directory
Use mobile threat defense tooling to flag apps that repeatedly invoke restricted-profile administration APIs without a legitimate device policy role

Monitoring Recommendations

Enroll managed devices in an MDM that reports Android security patch level and alerts when devices lag the September 2026 bulletin
Monitor installed application inventories for newly sideloaded APKs on privileged users' devices
Track outbound network activity from suspicious apps that may exfiltrate files obtained through the confused deputy path

How to Mitigate CVE-2026-28603

Immediate Actions Required

Apply the Android security patch level dated 2026-09-01 or later on all managed devices
Prioritize patching for devices used by administrators, executives, and users with access to sensitive corporate data
Restrict installation of third-party apps through MDM policy until affected devices are updated

Patch Information

Google addressed CVE-2026-28603 in the September 2026 Android security patch level. Device manufacturers ship the fix in over-the-air updates that align with the Android Security Bulletin September 2026. Verify the device patch level under Settings and confirm it reports 2026-09-01 or later before considering a device remediated.

Workarounds

No vendor-published workaround exists; apply the OEM security update as soon as it becomes available
Enforce an MDM policy that blocks installation of apps from unknown sources on managed devices
Remove or disable non-essential applications on devices that cannot receive the September 2026 patch immediately

bash

# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later