CVE-2026-28663 Overview
CVE-2026-28663 is a local privilege escalation vulnerability in the Android LauncherAppsService component. The flaw resides in the buildIntentSenderForUser method of LauncherAppsService.java. A logic error allows a local application to bypass Background Activity Launch (BAL) restrictions and start an activity from the background without user interaction. Successful exploitation grants an attacker elevated privileges within the context of the targeted user or component. The vulnerability is classified under CWE-863: Incorrect Authorization and was addressed in the Android Security Bulletin September 2026.
Critical Impact
A local application can escalate privileges by launching activities from the background without user interaction, enabling UI hijacking and unauthorized access to protected components.
Affected Products
- Android Open Source Project (AOSP) framework — LauncherAppsService
- Android device builds prior to the September 2026 security patch level
- OEM Android distributions inheriting the affected LauncherAppsService.java implementation
Discovery Timeline
- 2026-09-01 - Fix published in the Android Security Bulletin September 2026
- 2026-09-08 - CVE-2026-28663 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28663
Vulnerability Analysis
The vulnerability exists in buildIntentSenderForUser within LauncherAppsService.java, a system service that brokers launcher-related operations for installed applications. The method constructs an IntentSender that other components can invoke on behalf of the caller. Android enforces Background Activity Launch (BAL) restrictions to prevent apps from starting activities while not in the foreground. The affected code path fails to correctly propagate or enforce the BAL policy on the intent sender it builds. A local application can obtain an intent sender that, when triggered, launches activities as if the originating caller were foreground-privileged. This produces a background activity launch that should have been blocked by the platform.
Root Cause
The root cause is an authorization gap [CWE-863] in buildIntentSenderForUser. The service issues an intent sender without applying the caller's BAL restrictions to the resulting PendingIntent. When another component later fires the intent, the system evaluates the sender's privileges rather than the actual originator, permitting a launch that circumvents the platform's background activity controls.
Attack Vector
Exploitation requires a local, low-privileged application installed on the device. No user interaction is needed. The malicious application requests an intent sender through the LauncherAppsService API and then triggers it from the background. The resulting activity launch bypasses BAL enforcement, enabling the attacker to display attacker-controlled UI over other apps, hijack tasks, or reach components that assume foreground provenance. The attack does not require additional execution privileges beyond those held by an ordinary installed app.
No verified public exploit code is available at the time of publication. Technical details are described in the Android Security Bulletin September 2026.
Detection Methods for CVE-2026-28663
Indicators of Compromise
- Unexpected activities launching in the foreground while the originating application was in the background or stopped state.
- Applications repeatedly invoking LauncherApps APIs such as startShortcut or getShortcutIntent outside of typical launcher workflows.
- New or updated third-party apps that register unusual shortcut or intent sender interactions shortly before anomalous UI events.
Detection Strategies
- Review logcat and ActivityTaskManager traces for activity starts attributed to callers that were not in a resumed state.
- Monitor system events for PendingIntent invocations originating from LauncherAppsService where the underlying app lacks a foreground process.
- Correlate mobile threat defense telemetry for apps that request launcher APIs while running background services.
Monitoring Recommendations
- Track Android security patch level across the mobile fleet and flag devices below the September 2026 patch level.
- Enroll devices in a mobile management solution capable of reporting installed application inventory and runtime behaviors.
- Alert on sideloaded applications or apps from untrusted sources that request LAUNCHER_APPS related permissions.
How to Mitigate CVE-2026-28663
Immediate Actions Required
- Apply the September 2026 Android security patch (patch level 2026-09-01 or later) to all managed devices.
- Prioritize patching for devices running sensitive workloads, BYOD endpoints, and executive devices.
- Restrict installation of applications from unknown sources through mobile device management (MDM) policy.
Patch Information
The fix is delivered through the Android Security Bulletin September 2026. Device vendors distribute the corrected LauncherAppsService.java implementation through their monthly security patch level updates. Verify the device's security patch level in Settings under About phone.
Workarounds
- Limit installed applications to those distributed through vetted enterprise or official app stores until patches are applied.
- Use MDM controls to disable installation of unknown apps and to block applications requesting excessive launcher-related interactions.
- Remove or disable third-party launchers and low-trust applications on devices that cannot immediately receive the September 2026 update.
# Verify Android security patch level on a managed device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.