CVE-2026-28644 Overview
CVE-2026-28644 is a local privilege escalation vulnerability in the Android ActivityTaskManagerService.java component. The flaw resides in the startNextMatchingActivity function and results from a confused deputy condition classified under [CWE-441]. An attacker with local access can bypass permission checks and elevate privileges without user interaction. Exploitation requires no additional execution privileges, making the flaw usable by any installed application. Google addressed the issue in the Android Security Bulletin September 2026.
Critical Impact
A local application can escalate privileges on the device without user interaction, gaining access to functionality reserved for higher-privileged components.
Affected Products
- Android Open Source Project (AOSP)
- Android devices running unpatched builds prior to the September 2026 security patch level
- OEM Android distributions that incorporate the affected ActivityTaskManagerService component
Discovery Timeline
- 2026-09-08 - CVE-2026-28644 published to the National Vulnerability Database
- 2026-09-10 - Entry last modified in the NVD database
Technical Details for CVE-2026-28644
Vulnerability Analysis
The vulnerability exists in startNextMatchingActivity within ActivityTaskManagerService.java, a core system service that manages activity lifecycle and task stacks in Android. The function fails to properly validate the identity and permissions of the calling component when forwarding activity start requests to the next matching activity in a task. This creates a confused deputy scenario in which a privileged system component performs an action on behalf of a lower-privileged caller, using the system's own authority rather than the caller's.
Because ActivityTaskManagerService runs with elevated system privileges, any bypass of its permission enforcement grants callers access to activities and operations they should not reach. The attack requires only local access via an installed application and no user interaction, which broadens the exposure across the Android ecosystem.
Root Cause
The root cause is improper caller-identity handling in startNextMatchingActivity. When the system service resolves the next activity to start, it does not consistently propagate or re-check the original caller's permissions against the target component. The service acts as a deputy for the requesting app while retaining system authority, allowing a component that would normally be blocked by permission checks to be launched.
Attack Vector
Exploitation is local and requires low privileges. A malicious application installed on the device invokes an activity chain that triggers startNextMatchingActivity, causing the system service to launch a target activity that the caller lacks permission to reach directly. The specific interaction pattern and target components are described in the Android Security Bulletin September 2026. No verified public proof-of-concept is available at this time.
Detection Methods for CVE-2026-28644
Indicators of Compromise
- Unexpected activity launches originating from untrusted applications targeting system or privileged components
- Applications invoking startNextMatchingActivity sequences that cross package permission boundaries
- Logcat entries in ActivityTaskManager showing activity starts inconsistent with the caller's declared permissions
Detection Strategies
- Monitor mobile device management (MDM) telemetry for devices reporting a security patch level earlier than September 2026
- Review installed applications for behaviors that repeatedly probe system activities via chained intents
- Correlate application install events with subsequent anomalous activity-launch patterns in device logs
Monitoring Recommendations
- Enforce minimum Android security patch level policies through enterprise mobility management
- Track sideloaded APK installations and applications from non-verified sources
- Alert on privilege-sensitive activity launches that follow recently installed third-party applications
How to Mitigate CVE-2026-28644
Immediate Actions Required
- Apply the Android September 2026 security patch level or later to all managed devices
- Prioritize patching for devices used by high-value users and those permitting sideloading
- Remove untrusted third-party applications, particularly those installed outside Google Play
Patch Information
Google published the fix in the Android Security Bulletin dated September 1, 2026. Device manufacturers integrate the patch into their monthly security updates. Confirm remediation by verifying the device reports a security patch level of 2026-09-01 or later under Settings, then apply OEM updates as they become available. Full details are in the Android Security Bulletin September 2026.
Workarounds
- Restrict application installation to Google Play and vetted enterprise stores
- Enforce Play Protect scanning and block sideloaded APKs through MDM policy
- Retire or isolate devices that no longer receive vendor security updates
# Verify Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output for a patched device: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
