CVE-2026-28612 Overview
CVE-2026-28612 is a high-severity intent redirection vulnerability in the Android platform. The flaw resides in the resolveActivity method of ActivityStarter.java. A logic error in the activity resolution code allows a local attacker to redirect intents to unintended components. Successful exploitation results in local privilege escalation without requiring user interaction or additional execution privileges. The weakness is categorized under [CWE-693] (Protection Mechanism Failure).
Critical Impact
A local application with low privileges can escalate to higher-privileged contexts by redirecting intents through resolveActivity, potentially accessing protected components and data on the affected device.
Affected Products
- Android platform (frameworks/base — ActivityStarter.java)
- Devices covered by the Android Security Bulletin dated September 2026
- Downstream Android distributions incorporating the affected framework code
Discovery Timeline
- 2026-09-08 - CVE-2026-28612 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28612
Vulnerability Analysis
The vulnerability exists in the resolveActivity function within ActivityStarter.java, a core component of the Android Activity Manager responsible for resolving and launching activities from Intent objects. A logic error in the resolution flow allows an attacker-controlled Intent to be redirected to a component the caller should not be able to invoke directly.
Intent redirection occurs when a privileged process forwards or resolves an attacker-supplied Intent without adequately validating the target component. In this case, the resolution path in resolveActivity fails to enforce the expected protection mechanism, letting a local, unprivileged application coerce the system into launching a component under a higher-privileged identity.
Because the flaw is triggered during normal activity resolution, exploitation does not require user interaction. The attack vector is local, meaning the adversary must already run code on the device, typically through a malicious or compromised application installed on the target.
Root Cause
The root cause is a protection mechanism failure ([CWE-693]) in the intent resolution logic. resolveActivity selects a target component based on Intent attributes without correctly enforcing the security check that should prevent redirection to privileged components. This gap allows an unprivileged caller to influence which component the system ultimately launches.
Attack Vector
Exploitation requires local access via an installed application. The malicious app crafts an Intent designed to reach the vulnerable code path in resolveActivity. When the system resolves the intent, the flawed logic dispatches execution to a component the caller could not otherwise invoke, resulting in privilege escalation within the Android runtime. No user interaction and no additional permissions are needed. Technical details are available in the Android Security Bulletin September 2026.
Detection Methods for CVE-2026-28612
Indicators of Compromise
- Unexpected activity launches originating from third-party applications targeting system or privileged components.
- Applications issuing Intent objects whose resolved component differs from the declared target package.
- Logcat entries from ActivityTaskManager or ActivityStarter showing anomalous resolution of implicit intents to privileged components.
Detection Strategies
- Review installed applications on managed Android devices for recently sideloaded or updated packages that request broad intent capabilities.
- Monitor Android platform logs for repeated startActivity calls that resolve to system UID components from non-system callers.
- Use mobile threat defense tooling to flag applications exhibiting intent redirection or component hijacking behavior.
Monitoring Recommendations
- Ingest mobile device telemetry, including application install events and Android system logs, into a centralized analytics platform for correlation.
- Track the Android security patch level (ro.build.version.security_patch) across the device fleet and alert on devices below the September 2026 patch level.
- Establish baselines for inter-application intent traffic on managed devices and alert on deviations targeting privileged components.
How to Mitigate CVE-2026-28612
Immediate Actions Required
- Apply the September 2026 Android security patch level (2026-09-01 or later) to all managed Android devices.
- Inventory devices unable to receive the patch and prioritize replacement or restriction from sensitive resources.
- Enforce a mobile device management (MDM) policy that blocks installation of applications from untrusted sources.
Patch Information
Google addressed CVE-2026-28612 in the Android security patch level dated 2026-09-01. Device manufacturers integrate the framework fix into their own monthly security updates. Refer to the Android Security Bulletin September 2026 for the authoritative fix reference and impacted source paths.
Workarounds
- Restrict device access to enterprise resources until the September 2026 patch is confirmed installed.
- Require applications on managed devices to originate from vetted enterprise or Google Play sources only.
- Remove or disable non-essential third-party applications on high-value devices pending patch deployment.
# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.