CVE-2026-28626 Overview
CVE-2026-28626 is an intent redirection vulnerability in the onCreate method of SetupPassthroughActivity.java on Android. The flaw allows a local attacker to launch arbitrary activities within the context of the vulnerable component. Successful exploitation results in local escalation of privilege without requiring additional execution privileges. The issue is tracked under CWE-601 (URL Redirection to Untrusted Site) and disclosed in the Android Security Bulletin September 2026. User interaction is required for exploitation, which limits automated abuse but does not prevent targeted attacks through social engineering.
Critical Impact
A malicious local application can redirect an intent through SetupPassthroughActivity to launch privileged activities, gaining access to components normally protected by permission boundaries.
Affected Products
- Android platform (component: SetupPassthroughActivity.java)
- Devices receiving the Android Security Bulletin September 2026 patch level
- OEM builds derived from the affected AOSP branches
Discovery Timeline
- 2026-09-08 - CVE-2026-28626 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28626
Vulnerability Analysis
The vulnerability resides in the onCreate method of SetupPassthroughActivity, an activity involved in Android's setup flow. The activity accepts an inbound Intent and forwards it to another component without adequately validating the target. An unprivileged application can craft an Intent that references a component the caller could not otherwise reach directly. When SetupPassthroughActivity forwards the request, the target activity is launched with the privileges of the setup component rather than the caller. This pattern, commonly referred to as intent redirection, effectively lends the caller a privileged execution context for launching restricted activities.
Root Cause
The root cause is missing validation of the redirected Intent inside onCreate. The activity trusts a caller-supplied extra or Intent payload and passes it to startActivity without confirming the target component, package, or exported status. Because SetupPassthroughActivity runs in a privileged process context associated with device setup, its launches bypass permission checks that would otherwise apply to the caller.
Attack Vector
Exploitation requires a local malicious application installed on the device and user interaction to trigger the redirection flow. The malicious app sends a crafted Intent targeting SetupPassthroughActivity, embedding a nested Intent that points to an internal activity the attacker wishes to invoke. When the user interacts with the resulting UI, the passthrough activity forwards the nested Intent, launching the internal activity under the privileges of the setup component. This yields access to functionality that would normally require system-level permissions.
No verified public proof-of-concept code is available. For component-level details, refer to the Android Security Bulletin September 2026.
Detection Methods for CVE-2026-28626
Indicators of Compromise
- Unexpected launches of setup-related or system activities initiated from third-party application packages.
- Log entries in ActivityManager (logcat) showing SetupPassthroughActivity forwarding intents to non-setup components.
- Installation of untrusted applications that declare intent filters targeting Android setup components.
Detection Strategies
- Review Android logcat and dumpsys activity output for chains where SetupPassthroughActivity is invoked by a non-system UID and immediately starts another activity.
- Perform static analysis of installed APKs for calls to startActivity targeting com.google.android.setupwizard or similar passthrough components with embedded EXTRA_INTENT payloads.
- Correlate device patch level (ro.build.version.security_patch) against the September 2026 Android Security Bulletin to identify unpatched endpoints.
Monitoring Recommendations
- Ingest mobile device management (MDM) telemetry and Android security patch levels into a central data lake for fleet-wide gap analysis.
- Monitor enterprise app catalogs for sideloaded or newly installed applications on devices running pre-September 2026 patch levels.
- Alert on Android devices that fail to receive the September 2026 or later security patch within defined SLAs.
How to Mitigate CVE-2026-28626
Immediate Actions Required
- Apply the Android Security Bulletin September 2026 patch level or later to all affected devices.
- Restrict installation of untrusted applications and enforce Google Play Protect on managed devices.
- Audit enterprise-managed Android fleets for devices running older security patch levels and prioritize remediation.
Patch Information
Google addressed CVE-2026-28626 in the Android Security Bulletin dated 2026-09-01. Devices must report a security patch level of 2026-09-01 or later to be considered remediated. OEMs typically ship the corresponding update through carrier or vendor over-the-air (OTA) channels. See the Android Security Bulletin September 2026 for source patch references and component mapping.
Workarounds
- Enforce an MDM policy that blocks installation of applications from unknown sources on affected devices.
- Educate users to avoid interacting with unexpected setup or configuration prompts triggered by third-party apps.
- Where feasible, disable or restrict access to legacy setup passthrough entry points via device configuration profiles until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.