CVE-2026-28607: Android Privilege Escalation Vulnerability

CVE-2026-28607 Overview

CVE-2026-28607 is a local privilege escalation vulnerability in Android caused by a confused deputy condition across multiple functions in multiple locations. The flaw allows a background activity launch (BAL) restriction bypass, enabling a malicious application to escalate privileges on the affected device. Exploitation requires no user interaction and no additional execution privileges beyond those already granted to a local, low-privileged app. The issue is tracked under [CWE-441: Unintended Proxy or Intermediary (Confused Deputy)] and was disclosed in the Android Security Bulletin for September 2026.

Critical Impact
An installed application can leverage a privileged Android component to launch background activities it could not launch directly, resulting in local escalation of privilege with high impact on confidentiality, integrity, and availability.

Affected Products

Android platform components referenced in the Android Security Bulletin September 2026
Devices running Android versions prior to the September 2026 security patch level
OEM Android builds inheriting the affected framework components

Discovery Timeline

2026-09-08 - CVE-2026-28607 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28607

Vulnerability Analysis

The vulnerability is a confused deputy weakness that appears in multiple functions across multiple locations in the Android platform. A privileged component performs an action on behalf of a caller without correctly verifying whether the caller is authorized to trigger that action. In this case, the privileged component launches an activity in the background even though the requesting app does not hold the required privileges under Android's background activity launch restrictions.

Android enforces BAL restrictions to prevent apps from starting activities while not in the foreground. These restrictions defend against overlay abuse, tapjacking, and stealth privilege escalation. When a privileged intermediary can be tricked into starting an activity on behalf of a background app, the caller effectively inherits the privileges of the intermediary. The result is local escalation of privilege with high confidentiality, integrity, and availability impact.

Root Cause

The root cause is inadequate caller verification within multiple system paths that broker activity launches. The privileged deputy fails to attribute the request to the actual originating app or fails to enforce BAL policy on the originator, so the launch proceeds under the deputy's context. This mismatch between the acting identity and the authorized identity is the defining characteristic of [CWE-441].

Attack Vector

Exploitation is local and requires only low privileges. A malicious app installed on the device sends a crafted request to the vulnerable system component. The component then launches an activity in the background on the attacker's behalf, bypassing BAL enforcement. No user interaction is required.

No public proof-of-concept code is available. Refer to the Android Security Bulletin September 2026 for authoritative technical details and patch references.

Detection Methods for CVE-2026-28607

Indicators of Compromise

Unexpected activity launches originating from apps that are not in the foreground or recently used
System log entries showing activity starts brokered by privileged components on behalf of low-privileged callers
Newly installed third-party apps requesting unusual IPC interactions with system services shortly before privileged UI appears

Detection Strategies

Review ActivityTaskManager and WindowManager logs for background-initiated activity launches attributed to system UIDs but triggered by third-party package names
Correlate app install events with subsequent anomalous foreground transitions of sensitive activities such as settings, accessibility, or device admin prompts
Hunt for repeated IPC calls from a single low-privileged package to system services that broker activity starts

Monitoring Recommendations

Ingest Android device telemetry and system logs into a centralized analytics platform for correlation across the fleet
Alert on background activity starts that bypass expected BAL policy on devices missing the September 2026 patch level
Track device security patch levels and flag endpoints that remain unpatched beyond your remediation SLA

How to Mitigate CVE-2026-28607

Immediate Actions Required

Apply the September 2026 Android security patch level or later on all managed devices
Enforce a minimum patch level policy in mobile device management (MDM) and block or quarantine noncompliant devices
Restrict sideloading and limit app installation to vetted sources such as managed enterprise stores

Patch Information

Google addressed CVE-2026-28607 in the Android security patch level dated September 1, 2026. See the Android Security Bulletin September 2026 for the list of fixed components and links to AOSP source changes. Device OEMs incorporate these fixes into carrier and vendor builds on their own release cadence.

Workarounds

Remove untrusted third-party applications from affected devices until the patch is installed
Disable installation from unknown sources and enforce Play Protect or an equivalent app-vetting control
Segment corporate data using work profiles so that untrusted apps cannot interact with sensitive activities

bash

# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later