CVE-2026-28614: Android SlicePermissionActivity Privilege Escalation

CVE-2026-28614 Overview

CVE-2026-28614 is a local privilege escalation vulnerability in the Android SlicePermissionActivity.java component. The flaw stems from a confused deputy condition in the onCreate method that enables a permission bypass. A local attacker with low privileges can escalate to elevated privileges without user interaction and without requiring additional execution privileges. The weakness is categorized under [CWE-441] (Unintended Proxy or Intermediary, also known as Confused Deputy).

Critical Impact
A local application can bypass Android's slice permission model to gain unauthorized access to protected resources, resulting in local privilege escalation without user consent.

Affected Products

Android Open Source Project (AOSP) — SlicePermissionActivity component
Android platform builds prior to the September 2026 security patch level
Downstream OEM Android distributions incorporating the affected framework code

Discovery Timeline

2026-09-08 - CVE-2026-28614 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28614

Vulnerability Analysis

The vulnerability resides in the onCreate method of SlicePermissionActivity.java, a framework component that prompts users to authorize slice-based content sharing between applications. The activity acts as a trusted intermediary when brokering permission grants between a slice provider and a requesting client. The confused deputy condition allows a malicious application to trick the activity into granting slice URI permissions it should not authorize. Because the framework component runs with system-level trust when issuing grants, the attacker inherits access to protected data without holding the associated permissions itself.

Root Cause

The root cause is improper validation of the caller and target within the permission-granting flow. SlicePermissionActivity fails to verify that the entity requesting the grant is entitled to represent the client identity supplied in the intent. This mirrors the classic [CWE-441] pattern where a privileged proxy performs an action on behalf of an untrusted principal without adequately confirming authorization.

Attack Vector

Exploitation requires a locally installed application on the target device. The malicious app crafts an intent targeting SlicePermissionActivity and supplies attacker-controlled parameters that reference a victim client and a protected slice URI. Because user interaction is not required, the activity can process the grant silently. On successful exploitation, the attacker's application obtains read or write access to slice-backed data that would normally require explicit user approval or protected permissions. Refer to the Android Security Bulletin September 2026 for the framework-level fix details.

Detection Methods for CVE-2026-28614

Indicators of Compromise

Unexpected invocations of SlicePermissionActivity originating from non-system, third-party packages
Slice URI permission grants recorded for applications that do not declare corresponding slice-related permissions in their manifest
Newly installed applications requesting access to sensitive slice providers shortly after installation

Detection Strategies

Monitor Android system logs (logcat) for SlicePermissionActivity transitions initiated without a foreground user context
Audit installed application manifests for intents that reference slice URIs against packages exposing sensitive slices
Compare device build fingerprints against the September 2026 Android security patch level to identify unpatched fleet devices

Monitoring Recommendations

Ingest mobile device management (MDM) telemetry into a centralized analytics platform to track patch level compliance across managed Android devices
Alert on installation of unvetted APKs on corporate-managed devices, particularly those requesting slice or content provider interactions
Track anomalous inter-process communication patterns involving system UI components on rooted or developer-mode devices

How to Mitigate CVE-2026-28614

Immediate Actions Required

Apply the September 2026 Android security patch level (2026-09-01 or later) to all managed devices
Enforce MDM policies that block installation of applications from untrusted sources on corporate devices
Inventory devices that cannot receive the patch and plan for replacement or additional compensating controls

Patch Information

Google addressed the vulnerability in the September 2026 Android Security Bulletin. Device manufacturers must ship builds at security patch level 2026-09-01 or later to remediate CVE-2026-28614. Consult the Android Security Bulletin September 2026 for the authoritative patch reference and affected component list.

Workarounds

Restrict installation of third-party applications on managed Android devices through MDM allowlists until patches are deployed
Disable or uninstall non-essential applications that request access to slice-backed content providers
Educate users to avoid sideloading APKs from untrusted repositories while patches propagate through OEM channels

bash

# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later