CVE-2026-28657: Android AppWidget Privilege Escalation Flaw

CVE-2026-28657 Overview

CVE-2026-28657 is a local privilege escalation vulnerability in the Android platform. The flaw resides in the onActivityResult method of AppWidgetConfigActivityProxy.java. A confused deputy condition allows an unauthorized URI permission grant. A local attacker can obtain elevated privileges without requiring additional execution rights or user interaction. The issue is tracked under [CWE-441: Unintended Proxy or Intermediary (Confused Deputy)] and was addressed in the Android Security Bulletin for September 2026.

Critical Impact
Local attackers can escalate privileges on affected Android devices by tricking a privileged system component into granting URI permissions it should not, exposing protected content providers.

Affected Products

Android platform (AppWidgetConfigActivityProxy component)
Devices receiving the Android Security Bulletin September 2026 patch level
OEM Android builds derived from affected AOSP source

Discovery Timeline

2026-09-08 - CVE-2026-28657 published to NVD
2026-09-01 - Fix documented in the Android Security Bulletin September 2026
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28657

Vulnerability Analysis

The vulnerability affects AppWidgetConfigActivityProxy, a system-side proxy that mediates configuration activities launched by app widgets. When a widget configuration activity completes, onActivityResult receives an Intent containing URIs and flag data returned by the calling widget host. The proxy forwards or acts on those URI grants without adequately validating that the caller was authorized to request them.

This is a classic confused-deputy pattern classified as [CWE-441]. The proxy runs with higher privileges than the requesting application. By returning a crafted result Intent with URI permission flags such as FLAG_GRANT_READ_URI_PERMISSION or FLAG_GRANT_WRITE_URI_PERMISSION, a local unprivileged app can cause the proxy to grant it access to content provider URIs that the app could not access directly.

Exploitation requires only local access and low privileges, and no user interaction is needed. Successful exploitation yields read and write access to protected content, enabling local escalation of privilege.

Root Cause

The root cause is insufficient validation of URI permission grants inside onActivityResult of AppWidgetConfigActivityProxy.java. The proxy trusts the returned Intent's URI and flag values and performs grants on behalf of the caller. Because the proxy holds broader authority than the requester, this trust boundary violation allows unauthorized access.

Attack Vector

A malicious local application registers or interacts with a widget configuration flow that routes through AppWidgetConfigActivityProxy. When the proxy invokes onActivityResult, the attacker-supplied result Intent includes URI permission flags targeting privileged content provider URIs. The proxy then propagates those grants to the malicious app, granting access without user consent.

See the Android Security Bulletin September 2026 for full technical details. No public proof-of-concept code is available for this issue.

Detection Methods for CVE-2026-28657

Indicators of Compromise

Unexpected URI permission grants to third-party applications targeting system or privileged content providers.
Applications accessing content URIs they were never granted permission to at install time.
Anomalous invocations of app widget configuration flows originating from applications without widget-related functionality.

Detection Strategies

Audit device patch levels to identify Android builds prior to the September 2026 security patch level.
Inspect logcat entries around AppWidgetConfigActivityProxy and grantUriPermission calls for unexpected callers.
Use mobile threat defense telemetry to flag applications abusing widget configuration Intents.

Monitoring Recommendations

Monitor for installations of unknown or side-loaded APKs on managed devices.
Track content provider access patterns for anomalies indicative of unauthorized URI grants.
Correlate mobile device management (MDM) compliance data with the Android Security Bulletin patch level of September 2026.

How to Mitigate CVE-2026-28657

Immediate Actions Required

Apply the Android Security Bulletin September 2026 patch level (2026-09-01 or later) to all affected devices.
Enforce MDM policies that block enrollment or access for devices below the required patch level.
Restrict installation of untrusted applications from outside vetted sources such as managed app catalogs.

Patch Information

The fix is included in the Android Security Bulletin published on September 1, 2026. Device manufacturers integrate the AOSP patch into their monthly security update. Confirm patch adoption by checking the device security patch level in Settings and by validating OEM firmware release notes against the Android Security Bulletin September 2026.

Workarounds

No vendor-supplied workaround is documented. Patch installation is the authoritative remediation.
Reduce exposure by limiting the number of installed third-party applications, particularly those requesting widget capabilities.
Use enterprise mobility policies to enforce Google Play Protect scanning and disable installation from unknown sources.

bash

# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-09-01 or later