CVE-2026-28656: Android DeviceAdminAdd Privilege Escalation

CVE-2026-28656 Overview

CVE-2026-28656 is a tapjacking vulnerability affecting multiple functions of DeviceAdminAdd.java in Android. An attacker can overlay the device administrator activation screen to trick users into granting elevated privileges to a malicious application. Successful exploitation leads to local privilege escalation without requiring additional execution privileges. User interaction is required for the attack to succeed. The weakness is categorized as [CWE-1021] Improper Restriction of Rendered UI Layers or Frames.

Critical Impact
A local attacker can escalate privileges by tricking users into approving device administrator access through an overlay attack.

Affected Products

Android (Wear OS component addressed in Android Security Bulletin 2026-09-01)
Devices running affected Android versions prior to the 2026-09-01 patch level
Systems exposing the DeviceAdminAdd activity to overlays

Discovery Timeline

2026-09-08 - CVE-2026-28656 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28656

Vulnerability Analysis

The vulnerability resides in multiple functions of DeviceAdminAdd.java, the activity responsible for presenting the device administrator activation consent screen. The activity does not adequately restrict rendered UI layers, allowing another application to draw a deceptive overlay on top of the consent prompt. When the user interacts with what appears to be a benign UI, the tap is actually delivered to the underlying administrator activation control.

Because device administrator privileges enable powerful actions such as password enforcement, wipe, and lock, granting them to a malicious application yields effective local privilege escalation. No additional execution privileges are required by the attacker beyond installing an application on the device and displaying an overlay window.

Root Cause

The root cause is missing UI redress protection in DeviceAdminAdd.java. Android provides mechanisms such as filterTouchesWhenObscured and setHideOverlayWindows to block or ignore touches when another window is drawn on top, but these controls were not consistently applied across the affected functions. Without those safeguards, tapjacking (a form of user interface confusion) succeeds against the consent flow.

Attack Vector

Exploitation requires a local application with permission to draw overlays, such as SYSTEM_ALERT_WINDOW. The malicious app launches or waits for the device administrator activation screen, then renders a transparent or misleading overlay that hides the true meaning of the underlying buttons. A user prompted to tap a decoy control unknowingly approves administrator privileges for the attacker's application. Because no verified proof of concept is published, refer to the Android Security Bulletin 2026-09-01 for authoritative technical details.

Detection Methods for CVE-2026-28656

Indicators of Compromise

Applications requesting SYSTEM_ALERT_WINDOW alongside BIND_DEVICE_ADMIN shortly after installation.
Unexpected entries under Settings > Security > Device admin apps that the user did not knowingly enable.
Foreground overlay activity coinciding with launches of the device administrator activation screen.

Detection Strategies

Enumerate installed applications holding active device administrator status and compare against an approved allowlist.
Monitor MDM or EMM telemetry for policy changes triggered by newly activated device admin components.
Review application install logs for sideloaded packages that request overlay and device admin permissions in the same session.

Monitoring Recommendations

Alert on the activation of new device administrator receivers on managed Android endpoints.
Track Android patch level compliance and flag devices below the 2026-09-01 security patch level.
Log and review use of the SYSTEM_ALERT_WINDOW permission by non-system applications.

How to Mitigate CVE-2026-28656

Immediate Actions Required

Apply the 2026-09-01 Android security patch level or later on all affected devices, including Wear OS builds.
Audit currently enabled device administrator applications and revoke access for any that are untrusted.
Restrict installation of applications from unknown sources on managed fleets through MDM policy.

Patch Information

The fix is delivered through the Android Security Bulletin 2026-09-01. Device vendors and carriers ship the patched DeviceAdminAdd.java as part of the monthly Android security update. Confirm the security patch level under Settings > About phone > Android security update.

Workarounds

Deny the SYSTEM_ALERT_WINDOW permission for non-essential applications through device management policy.
Educate users to dismiss unexpected overlays before interacting with security consent prompts.
Enable Google Play Protect to identify applications abusing overlay and device admin capabilities.

bash

# Check current Android security patch level via adb
adb shell getprop ro.build.version.security_patch

# List active device administrator components
adb shell dpm list-owners
adb shell dumpsys device_policy | grep -i "admin"