CVE-2026-28631: Android IntentForwarderActivity Privilege Escalation

CVE-2026-28631 Overview

CVE-2026-28631 is a local privilege escalation vulnerability in the Android IntentForwarderActivity component. The flaw resides in the buildMiniResolver method of IntentForwarderActivity.java, where a tapjacking or overlay attack can bypass user consent controls. A malicious application installed on the device can draw an overlay on top of the resolver UI to trick the system into performing intent forwarding actions without informed user consent. The issue is classified under [CWE-601] and was addressed in the Android Security Bulletin for September 2026.

Critical Impact
Local escalation of privilege on affected Android devices with no additional execution privileges and no user interaction required beyond installing the malicious app.

Affected Products

Android Open Source Project (AOSP) — IntentForwarderActivity component
Android devices missing the September 2026 security patch level
OEM Android builds derived from affected AOSP branches

Discovery Timeline

2026-09-01 — Fix published in the Android Security Bulletin for September 2026
2026-09-08 — CVE-2026-28631 published to NVD
2026-09-10 — Last updated in the NVD database

Technical Details for CVE-2026-28631

Vulnerability Analysis

The vulnerability affects buildMiniResolver inside IntentForwarderActivity.java. This activity mediates intents that cross Android user or profile boundaries, such as forwarding an intent from a work profile to a personal profile. The mini resolver presents a confirmation surface intended to obtain explicit user consent before the cross-profile action proceeds.

Because the resolver UI does not sufficiently protect itself against overlays, a second application can draw content on top of the confirmation dialog. The user sees attacker-controlled visuals while their taps are delivered to the underlying consent surface. This lets an attacker forward intents into a privileged context that the user never knowingly approved, achieving local privilege escalation across profile or user boundaries.

Root Cause

The root cause is missing overlay protection on a security-relevant consent surface. The mini resolver built by buildMiniResolver does not set flags such as setFilterTouchesWhenObscured(true) or otherwise reject touch events delivered through another window. The activity therefore treats obscured taps as legitimate user consent, breaking the trust boundary the resolver is meant to enforce.

Attack Vector

Exploitation is local. A malicious app installed on the device draws a transparent or misleading overlay over the IntentForwarderActivity mini resolver while a cross-profile intent is being handled. The overlay guides the victim to tap in a region that maps to the consent button underneath. No additional execution privileges are needed, and no legitimate user interaction with the resolver is required beyond ordinary device use. The result is a forwarded intent executing in a target profile with the associated privileges.

No public proof-of-concept exploit is listed in the CVE data. Technical specifics are described in the Android Security Bulletin September 2026.

Detection Methods for CVE-2026-28631

Indicators of Compromise

Installed applications holding the SYSTEM_ALERT_WINDOW permission that also invoke cross-profile intents targeting IntentForwarderActivity.
Unexpected cross-profile intent deliveries recorded in ActivityManager logs shortly after overlay windows are shown.
Applications repeatedly launching activities while another app is drawing on top of the screen.

Detection Strategies

Inventory Android devices and confirm the security patch level is September 2026 or later.
Review installed apps for overlay permissions and correlate with use of startActivityAsUser or cross-profile intent APIs.
Use mobile threat defense telemetry to flag apps that combine overlay rendering with intent forwarding behavior.

Monitoring Recommendations

Monitor MDM or EMM compliance reports for devices below the September 2026 patch level.
Alert on new app installations requesting SYSTEM_ALERT_WINDOW on managed work-profile devices.
Track anomalous activity transitions between work and personal profiles in enterprise mobility logs.

How to Mitigate CVE-2026-28631

Immediate Actions Required

Apply the Android September 2026 security patch level to all managed devices as soon as the OEM release is available.
Restrict or deny the SYSTEM_ALERT_WINDOW permission through MDM policy on managed devices.
Remove unnecessary or untrusted applications, especially those requesting overlay permissions without a clear business need.

Patch Information

Google addressed the issue in the Android Security Bulletin September 2026. Devices must reach the 2026-09-01 security patch level or later to receive the fix. OEM and carrier update timing varies, so enterprises should validate patch propagation across their device fleet.

Workarounds

Disable overlay permission for non-essential applications until the patch is deployed.
Enforce work-profile separation policies that limit which apps can be installed alongside sensitive profiles.
Educate users to dismiss unexpected overlays and to avoid tapping through unfamiliar prompts.

bash

# Configuration example: revoke overlay permission for a suspect package via adb
adb shell appops set <package.name> SYSTEM_ALERT_WINDOW deny

# Verify current Android security patch level
adb shell getprop ro.build.version.security_patch