CVE-2026-28650 Overview
CVE-2026-28650 is a local privilege escalation vulnerability in the Android framework. The flaw resides in the setHiddenWhileSuspended method of WindowState.java. A logic error allows an attacker to bypass overlay restrictions on suspended applications. Exploitation requires no user interaction and no additional execution privileges beyond those already held by a local application.
The issue is tracked under CWE-693: Protection Mechanism Failure and was addressed in the Android Security Bulletin September 2026.
Critical Impact
A local application can bypass window overlay protections on suspended apps, enabling privilege escalation with high impact to confidentiality, integrity, and availability.
Affected Products
- Android Open Source Project (AOSP) framework
- Android devices receiving the September 2026 security patch level
- Downstream Android distributions incorporating the affected WindowState.java
Discovery Timeline
- 2026-09-08 - CVE-2026-28650 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28650
Vulnerability Analysis
The vulnerability exists in the setHiddenWhileSuspended method of WindowState.java, part of the Android Window Manager Service. Android suspends applications to restrict their ability to display windows or overlays on top of other apps. The setHiddenWhileSuspended routine enforces this restriction by hiding windows belonging to suspended packages.
A logic error in the method allows certain windows to remain visible or become visible again even while the parent application is suspended. This defeats the protection mechanism that isolates suspended apps from the active user session. An attacker with local access can leverage the bypass to display overlays that impersonate trusted UI or capture user input directed at other applications.
Root Cause
The root cause is a protection mechanism failure classified under CWE-693. The conditional logic that gates window visibility for suspended packages does not correctly cover all state transitions. As a result, the suspension check fails to hide windows in specific code paths, leaving the overlay restriction ineffective.
Attack Vector
Exploitation requires local access with low privileges, typically an installed application on the device. No user interaction is required. An attacker plants a malicious application that requests overlay capabilities and then triggers the suspension state transition that exposes the logic error. The malicious overlay then renders on top of privileged UI, enabling tapjacking, credential capture, or interaction with sensitive system dialogs. Successful exploitation results in escalation of privilege within the Android security model.
No public proof-of-concept code has been published for this issue. Refer to the Android Security Bulletin September 2026 for vendor technical details.
Detection Methods for CVE-2026-28650
Indicators of Compromise
- Applications requesting SYSTEM_ALERT_WINDOW or TYPE_APPLICATION_OVERLAY permissions without a clear user-facing justification.
- Windows attributed to suspended packages appearing on top of foreground activities in dumpsys window output.
- Unexpected UI overlays rendered immediately before or after PackageManager.setPackagesSuspended state changes.
Detection Strategies
- Inspect dumpsys window windows for windows whose owning package is in a suspended state but where mHiddenWhileSuspended is false.
- Audit installed applications for overlay permission grants paired with PACKAGE_SUSPENDED broadcast receivers.
- Correlate mobile threat defense telemetry that flags tapjacking behaviors with the September 2026 Android security patch level of the device.
Monitoring Recommendations
- Track Android security patch levels across the managed device fleet and alert when devices fall behind the September 2026 baseline.
- Monitor enterprise app distribution channels for applications abusing overlay APIs.
- Forward Android device attestation and patch-level telemetry to a centralized data lake for longitudinal analysis.
How to Mitigate CVE-2026-28650
Immediate Actions Required
- Apply the September 2026 Android security patch level (2026-09-01 or later) to all affected devices.
- Enforce a minimum patch level policy through mobile device management (MDM) and block noncompliant devices from sensitive resources.
- Review and revoke overlay permissions (SYSTEM_ALERT_WINDOW) for applications that do not require them.
Patch Information
Google addressed CVE-2026-28650 in the September 2026 Android Security Bulletin. Device manufacturers must incorporate the AOSP fix into vendor images and distribute over-the-air updates. Consult the Android Security Bulletin September 2026 for the source patch references and affected component details.
Workarounds
- Restrict sideloading and enforce installation only from vetted enterprise or Google Play sources.
- Disable overlay permissions for untrusted applications through MDM configuration profiles.
- Segment devices lacking the September 2026 patch from high-value corporate applications until vendor updates are available.
# Verify current Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Inspect window state for suspended packages exposing overlays
adb shell dumpsys window windows | grep -E "Window|mHiddenWhileSuspended|package"
# List packages holding SYSTEM_ALERT_WINDOW permission
adb shell cmd appops query-op SYSTEM_ALERT_WINDOW allow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.