CVE-2026-28642 Overview
CVE-2026-28642 is a local privilege escalation vulnerability in the Android operating system. The flaw resides in the executeRequest method of ActivityStarter.java, where a logic error permits a background activity launch that should be blocked. An attacker with local access and low privileges can leverage this issue to escalate privileges without user interaction. The vulnerability is classified under [CWE-693] (Protection Mechanism Failure), reflecting a bypass of an existing Android security control rather than a memory safety defect. Google addressed the issue in the Android Security Bulletin September 2026.
Critical Impact
A local application can bypass Android background activity launch restrictions to escalate privileges and gain access to sensitive user data or system functionality without any user interaction.
Affected Products
- Android platform component ActivityStarter.java
- Android versions addressed in the September 2026 security patch level
- Devices pending the 2026-09-01 security patch level
Discovery Timeline
- 2026-09-08 - CVE-2026-28642 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28642
Vulnerability Analysis
The vulnerability exists in the executeRequest function of ActivityStarter.java, a core component of the Android Activity Manager Service responsible for validating and dispatching activity launch requests. Android enforces background activity launch (BAL) restrictions to prevent apps that are not in the foreground from starting activities that could hijack the user interface or elevate their execution context. A logic error in executeRequest fails to correctly evaluate the launch conditions, allowing a request that should be denied to proceed.
Because the check happens inside system_server, a successful bypass allows a malicious app to launch an activity in a context it would not otherwise reach. This can be chained with subsequent user interface redressing or interaction with privileged components, resulting in local escalation of privilege. Exploitation requires no additional execution privileges and no user interaction, which lowers the barrier for malicious applications distributed through unofficial channels.
Root Cause
The root cause is a protection mechanism failure ([CWE-693]) in the request validation logic. The conditional checks that gate background activity launches do not fully cover the request state, so a crafted launch request satisfies the incorrect predicate and is permitted.
Attack Vector
The attack vector is local. A malicious application installed on the device issues an activity launch request from the background using parameters that trigger the flawed logic branch in executeRequest. No user interaction is required, and no additional permissions beyond those normally granted to installed apps are needed. Refer to the Android Security Bulletin September 2026 for the vendor's technical description.
No verified public proof-of-concept code is available at the time of publication.
Detection Methods for CVE-2026-28642
Indicators of Compromise
- Applications launching activities while not in the foreground and without a visible entry point in recent apps.
- Unexpected foreground activities appearing immediately after installing a new or updated third-party application.
- system_server log entries in logcat referencing ActivityStarter and background launch decisions with atypical calling UIDs.
Detection Strategies
- Review the device security patch level (ro.build.version.security_patch) across the mobile fleet and flag devices missing the 2026-09-01 patch level.
- Use Mobile Threat Defense telemetry to identify apps that request startActivity from background services or broadcast receivers at unusual rates.
- Correlate application installation events with subsequent unexpected activity launches within short time windows.
Monitoring Recommendations
- Enroll Android devices in a Mobile Device Management (MDM) solution that reports patch level and installed application inventory.
- Monitor Google Play Protect and enterprise app vetting results for applications abusing activity launch APIs.
- Alert on sideloaded APKs, downgrades of system components, and applications with excessive background execution.
How to Mitigate CVE-2026-28642
Immediate Actions Required
- Apply the Android security patch level 2026-09-01 or later on all managed devices as soon as the OEM releases it.
- Restrict installation of applications from unknown sources through MDM policy on corporate and BYOD devices.
- Audit installed applications and remove any that are unsigned, unused, or sourced outside vetted distribution channels.
Patch Information
Google published the fix in the Android Security Bulletin September 2026. Device manufacturers integrate the AOSP patch and distribute it as part of the 2026-09-01 security patch level. Confirm receipt of the update on each device model by checking Settings and enforcing a minimum patch level through enterprise mobility policies.
Workarounds
- Block installation of untrusted applications and enforce Google Play Protect on managed Android devices until patches are deployed.
- Apply MDM configuration profiles that restrict which apps can run in the background or auto-start on boot.
- Isolate high-risk users on devices that cannot receive the September 2026 patch by rotating them to patched hardware.
# Verify current Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output should be 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
