CVE-2026-28655: Android RemoteViews Privilege Escalation Flaw

CVE-2026-28655 Overview

CVE-2026-28655 is a logic flaw in multiple functions of RemoteViews.java in the Android framework. The defect allows a local attacker to bypass background activity launch (BAL) restrictions, resulting in local privilege escalation. Exploitation requires no user interaction and no additional execution privileges beyond those already held by a low-privileged local app. Google disclosed the issue in the Android Security Bulletin dated 2026-09-01. The vulnerability is classified under CWE-693: Protection Mechanism Failure.

Critical Impact
A malicious local application can bypass Android's background activity launch protections and escalate privileges without user interaction, enabling UI hijack, tapjacking, and follow-on token or credential theft.

Affected Products

Android framework (RemoteViews component)
Android versions addressed in the 2026-09-01 security patch level
Devices from OEMs following the Android Open Source Project (AOSP) monthly patch cadence

Discovery Timeline

2026-09-01 - Fix published in the Android Security Bulletin 2026-09-01
2026-09-08 - CVE-2026-28655 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD

Technical Details for CVE-2026-28655

Vulnerability Analysis

The defect lives in multiple functions of RemoteViews.java, the Android framework class used to describe view hierarchies that one process can render inside another. RemoteViews is the mechanism behind app widgets, notifications, and custom slice content. Because a RemoteViews payload crosses process boundaries and is ultimately rendered by a privileged host (for example, the system UI or launcher), any weakness in its action dispatch can promote a local caller's capabilities.

The reported issue is a logic error rather than a memory corruption bug. The affected code paths do not correctly enforce Android's background activity launch restrictions when the actions embedded in a RemoteViews object trigger an activity start. A local application that can deliver a crafted RemoteViews to a privileged renderer can cause an activity to launch from the background outside the visibility conditions Android normally requires.

The practical impact is local escalation of privilege. The launched activity inherits the launch context of the privileged process, which can be abused to overlay legitimate UI, capture user input intended for other apps, or chain into further token and credential abuse. Because user interaction is not required and privileges are PR:L, standard app-store malware and pre-installed low-privileged code are viable delivery vectors.

Root Cause

The root cause is a protection mechanism failure [CWE-693] in how RemoteViews action handlers evaluate whether the invoking context is allowed to start an activity in the background. A missing or incorrectly evaluated condition permits the action to proceed under the trusted renderer's identity, defeating the BAL policy enforced elsewhere in the framework.

Attack Vector

A local attacker publishes a widget, notification, or custom RemoteViews payload from an unprivileged application. When the privileged host process inflates and dispatches actions from that payload, the flawed code path launches an attacker-controlled activity from the background. The attacker then leverages the on-top activity to phish credentials, harvest tokens, or interact with sensitive system dialogs. No user tap or consent prompt is required.

No verified public proof-of-concept code is available at the time of publication. Refer to the Android Security Bulletin 2026-09-01 for the fix commits and affected version ranges.

Detection Methods for CVE-2026-28655

Indicators of Compromise

Unexpected foreground activities launched by apps that were not recently interacted with, particularly following widget updates or posted notifications.
Applications posting large volumes of custom RemoteViews notifications or widgets shortly before overlay or credential-prompt behavior appears.
Mobile Device Management (MDM) telemetry showing devices running below the 2026-09-01 Android security patch level in production fleets.

Detection Strategies

Track the ro.build.version.security_patch property across managed devices and flag any device below 2026-09-01.
Correlate ActivityTaskManager logs (Activity start from background) with the identity of the requesting package to surface anomalous launches originating from widget or notification renderers.
Review app behavior for repeated RemoteViews action registrations against PendingIntent targets outside the posting app's own components.

Monitoring Recommendations

Ingest Android bugreport and logcat streams into a central analytics pipeline and alert on unexpected startActivity calls attributed to system UI on behalf of third-party apps.
Monitor MDM patch-compliance dashboards weekly to confirm September 2026 patch adoption across the fleet.
Watch for enterprise app-store submissions or sideloaded APKs that declare widget or notification listener capabilities without a clear functional need.

How to Mitigate CVE-2026-28655

Immediate Actions Required

Apply the Android 2026-09-01 security patch level or later to all managed devices as soon as OEM builds are available.
Enforce a minimum security patch level policy through MDM and block non-compliant devices from accessing sensitive corporate resources.
Audit installed applications with widget, notification, or slice providers and remove those that are unnecessary or untrusted.

Patch Information

Google addressed CVE-2026-28655 in the Android 2026-09-01 security patch level. Device manufacturers integrate the upstream AOSP fix and ship it in their September 2026 (or later) monthly update. Reference the Android Security Bulletin 2026-09-01 for the authoritative list of fixed components and CVE-to-commit mapping.

Workarounds

Restrict application sideloading on managed devices and require installation through vetted enterprise channels only.
Disable third-party widgets and notification access for high-risk user populations until patches are deployed.
Use MDM configuration to enforce screen lock and reduce the window in which a background-launched activity can capture user input.

bash

# Verify device is at or above the fixed Android security patch level
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-09-01 or later