CVE-2026-28630: Android ContactsPickerActivity Overlay Attack

CVE-2026-28630 Overview

CVE-2026-28630 is a tapjacking/overlay vulnerability in the Android ContactsPickerActivity component. The flaw resides in the onCreate method of ContactsPickerActivity.kt, where the activity fails to defend against UI overlay attacks. A malicious local application can display a misleading interface on top of the contacts picker, tricking the user into revealing contact information. Exploitation requires no additional execution privileges and no user interaction beyond normal application use. The issue is tracked under [CWE-601] and addressed in the Android Security Bulletin dated September 2026.

Critical Impact
Local information disclosure of contact data through UI redress attacks executed by an unprivileged application on the device.

Affected Products

Android platform component ContactsPickerActivity
Android builds addressed by the September 2026 Security Bulletin
Devices without the September 2026 security patch level applied

Discovery Timeline

2026-09-08 - CVE-2026-28630 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28630

Vulnerability Analysis

The vulnerability exists in the onCreate handler of ContactsPickerActivity.kt. The activity does not set flags that block untrusted overlays from drawing over its interface. As a result, a local application holding overlay-drawing capability can present a spoofed UI element on top of the contacts picker. The user believes they are interacting with benign controls while their taps are consumed by the underlying picker, causing contact records to be exposed to the attacker's context. The weakness is categorized as [CWE-601] and results in local information disclosure without requiring elevated privileges.

Root Cause

The root cause is missing overlay protection on a sensitive activity. Android provides mechanisms such as setFilterTouchesWhenObscured and the FLAG_WINDOW_IS_OBSCURED handling to reject touch events when another window overlays the current one. ContactsPickerActivity did not enforce these protections at creation time, allowing tapjacking to succeed against unsuspecting users.

Attack Vector

Exploitation is local. A malicious application installed on the same device draws an overlay window using the standard Android overlay APIs while the contacts picker is displayed. The overlay masks the true UI, and touches pass through to the picker beneath. The attacker application receives selected contact data by observing the resulting activity flow. The attack does not require additional user interaction beyond normal application handling. See the Android Security Bulletin September 2026 for platform-level technical details.

Detection Methods for CVE-2026-28630

Indicators of Compromise

Installed applications that request the SYSTEM_ALERT_WINDOW permission without a clear business purpose.
Unexpected overlay windows appearing during use of the Android contacts picker.
Contact records appearing in third-party application logs or outbound network traffic shortly after a picker interaction.

Detection Strategies

Inventory installed applications on managed Android devices and flag those holding overlay permissions.
Review application manifests for SYSTEM_ALERT_WINDOW and BIND_ACCESSIBILITY_SERVICE declarations paired with contact-related permissions.
Correlate contact database access events with foreground application state to identify anomalous access patterns.

Monitoring Recommendations

Monitor Mobile Device Management (MDM) telemetry for sideloaded APKs on managed devices.
Track patch level compliance against the September 2026 Android Security Bulletin baseline.
Alert on installation of applications that combine overlay capability with access to sensitive user data providers.

How to Mitigate CVE-2026-28630

Immediate Actions Required

Apply the September 2026 Android security patch level or later on all managed devices.
Audit installed applications and remove any that request overlay permissions without justification.
Restrict sideloading through MDM policy on corporate devices.

Patch Information

Google addressed CVE-2026-28630 in the Android Security Bulletin September 2026. Device manufacturers integrate the fix into vendor builds that report the 2026-09-01 security patch level. Administrators should confirm patch delivery through OEM update channels for each device model in scope.

Workarounds

Disable the Display over other apps permission for non-essential applications through Android settings or MDM policy.
Educate users to dismiss unexpected overlay prompts and to review permissions after installing new applications.
Enforce Google Play Protect scanning to reduce exposure to malicious overlay applications.

bash

# Configuration example: query overlay-capable packages via ADB
adb shell appops query-op --user 0 SYSTEM_ALERT_WINDOW allow