CVE-2026-28660: Information Disclosure Vulnerability

CVE-2026-28660 Overview

CVE-2026-28660 is a local information disclosure vulnerability affecting the Android operating system. The flaw resides in the getAllSessions method across multiple files, where a logic error creates a confused deputy condition. An attacker with local access and low privileges can read session information they should not be permitted to access. Exploitation requires no user interaction and no additional execution privileges beyond a standard app context. The issue is tracked under [CWE-693: Protection Mechanism Failure] and was published in the Android Security Bulletin September 2026.

Critical Impact
A local application can obtain session data belonging to other users or components without triggering permission checks or user prompts.

Affected Products

Android platform components implementing getAllSessions
Devices receiving the September 2026 Android Security Bulletin patch level
See the Android Security Bulletin September 2026 for the authoritative device and patch matrix

Discovery Timeline

2026-09-08 - CVE-2026-28660 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28660

Vulnerability Analysis

The vulnerability is a confused deputy weakness inside the getAllSessions implementation shared by multiple Android system files. A confused deputy occurs when a privileged component performs an action on behalf of a less privileged caller without correctly validating the caller's authority. In this case, the method returns session data across trust boundaries because the access decision relies on the caller reaching the code path rather than on an explicit identity or permission check.

The result is local information disclosure. A malicious application running with normal privileges can invoke the affected system service and receive session records that belong to other users or profiles on the device. There is no impact to integrity or availability, and the scope remains local to the device.

Root Cause

The root cause is a logic error in the getAllSessions code path that fails to enforce the calling identity against the returned session set. The protection mechanism exists but is applied incorrectly, matching the [CWE-693] classification. Session enumeration therefore returns records the caller is not authorized to view.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker installs or coerces execution of a low-privilege app on the target device. The app then calls the vulnerable system API and parses the returned session list to harvest data belonging to other users or profiles. Refer to the Android Security Bulletin September 2026 for the affected component references and patch identifiers.

Detection Methods for CVE-2026-28660

Indicators of Compromise

Unexpected invocations of the getAllSessions API from third-party or non-system UIDs
Applications requesting or accessing session data outside their declared scope
Cross-user or cross-profile data appearing in logs generated by non-privileged apps

Detection Strategies

Audit installed applications for use of session enumeration APIs that are not tied to a documented business function
Correlate mobile device management (MDM) telemetry with the Android patch level to identify devices below the September 2026 security patch level
Review application behavior in a mobile threat defense sandbox for cross-user session access patterns

Monitoring Recommendations

Track Android security patch levels across the fleet and flag devices missing the 2026-09-01 patch string
Alert on newly installed apps that request access to session-related system services shortly after installation
Monitor MDM compliance dashboards for devices that cannot receive vendor updates and route them to a remediation queue

How to Mitigate CVE-2026-28660

Immediate Actions Required

Apply the September 2026 Android security patch level (2026-09-01 or later) as soon as it is available from the device vendor
Restrict installation of untrusted applications through MDM policy while patches propagate
Inventory devices that cannot receive the fix and evaluate replacement or containment options

Patch Information

Google addressed CVE-2026-28660 in the September 2026 Android Security Bulletin. Device manufacturers and carriers ship the fix as part of the 2026-09-01 security patch level. Consult the Android Security Bulletin September 2026 for the source commits and component-specific patch references.

Workarounds

No vendor-supplied workaround is documented; applying the security patch is the supported remediation
Limit exposure by enforcing Google Play Protect and blocking sideloading through enterprise policy
Segment sensitive workloads onto managed work profiles that receive timely updates

bash

# Verify the Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later