CVE-2026-28636 Overview
CVE-2026-28636 is a local privilege escalation vulnerability in the Android PickActivity.java component. The flaw resides in the setupLayout method and allows attackers to bypass the "Install unknown apps" security restriction through a confused deputy condition [CWE-441]. A local attacker with low privileges can leverage a trusted component to perform actions on their behalf, escalating privileges without user interaction. The vulnerability is tracked in the Android Security Bulletin published September 2026.
Critical Impact
A local attacker can bypass the "Install unknown apps" restriction to install arbitrary applications, leading to local privilege escalation with high impact to confidentiality, integrity, and availability.
Affected Products
- Android Open Source Project (AOSP)
- Android platform component PickActivity
- Devices covered by the September 2026 Android Security Bulletin
Discovery Timeline
- 2026-09-08 - CVE-2026-28636 published to NVD
- 2026-09-01 - Addressed in Android Security Bulletin September 2026
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28636
Vulnerability Analysis
The vulnerability exists in the setupLayout method of PickActivity.java, part of the Android package installation workflow. Android enforces an "Install unknown apps" permission that requires per-source user consent before sideloading applications from untrusted origins. The PickActivity component fails to properly attribute the calling identity when performing the installation source check.
This mismatch creates a confused deputy condition [CWE-441]. A privileged system component acts on behalf of a lower-privileged caller without validating whether the caller itself holds the required "Install unknown apps" permission. The trusted component effectively lends its authority to the untrusted caller.
Exploitation results in local privilege escalation with high impact to confidentiality, integrity, and availability. No user interaction is required, which removes the consent prompt that normally gates sideloaded application installations.
Root Cause
The root cause is improper caller identity verification during layout setup in PickActivity. The activity accepts intents and processes installation source metadata without ensuring the originating package holds the REQUEST_INSTALL_PACKAGES permission. Trust decisions rely on the intermediary system context rather than the true initiator.
Attack Vector
An attacker with local access and low privileges crafts an intent that invokes PickActivity to initiate an installation flow. Because the deputy component performs the security check under its own privileged context, the "Install unknown apps" restriction is bypassed. The attacker can then install additional payloads that operate with elevated capabilities on the device.
The vulnerability manifests in the intent-handling and permission-attribution logic. See the Android Security Bulletin September 2026 for component-level details and fixed build fingerprints.
Detection Methods for CVE-2026-28636
Indicators of Compromise
- Unexpected package installations originating from applications that were never granted the REQUEST_INSTALL_PACKAGES permission.
- Package Manager logs (logcat entries tagged PackageInstaller or PackageManager) showing installation events without a preceding user consent prompt.
- Applications with unusual installer source attribution in pm list packages -i output.
Detection Strategies
- Monitor mobile device management (MDM) telemetry for installation events on devices missing the September 2026 Android security patch level.
- Correlate PackageInstaller intent activity with the calling UID to identify mismatches between the requesting application and the granted permission set.
- Baseline authorized sideload sources and alert on installations attributed to unexpected installer packages.
Monitoring Recommendations
- Track the ro.build.version.security_patch property across the managed device fleet to identify unpatched endpoints.
- Ingest mobile threat defense telemetry into a centralized data lake for cross-device correlation of anomalous install events.
- Enable auditing of Android package installation APIs and flag installations that bypass the standard consent activity.
How to Mitigate CVE-2026-28636
Immediate Actions Required
- Apply the Android security patch level 2026-09-01 or later on all managed Android devices.
- Enforce MDM policies that restrict installation of applications from unknown sources on corporate devices.
- Inventory installed applications and remove any unauthorized packages installed after devices became vulnerable.
Patch Information
Google addressed CVE-2026-28636 in the Android Security Bulletin September 2026. Devices with a security patch level of 2026-09-01 or later contain the fix. OEM patch availability varies; consult the device vendor's advisory for firmware release timing.
Workarounds
- Disable the REQUEST_INSTALL_PACKAGES permission for all non-essential applications via MDM configuration.
- Restrict user accounts on shared devices to profiles that cannot invoke package installation intents.
- Deploy a mobile threat defense agent capable of blocking sideloaded installations pending patch deployment.
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# List installed packages with their installer source for audit
adb shell pm list packages -i
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.