CVE-2026-45528 Overview
CVE-2026-45528 is a local privilege escalation vulnerability in the Android StorageManagerService.java component. The flaw resides in the getManageSpaceActivityIntent method, which constructs an unsafe PendingIntent that can be repurposed by a local attacker. This enables a LaunchAnyWhere attack chain, allowing a malicious application to launch arbitrary activities in the context of a privileged system process. Exploitation requires user interaction but no additional execution privileges. Google addressed the issue in the Android Security Bulletin for September 2026.
Critical Impact
A local, low-privileged application can escalate to system-level privileges by hijacking an unsafe PendingIntent handed out by StorageManagerService, leading to unauthorized activity launches and data compromise.
Affected Products
- Android Open Source Project (AOSP) StorageManagerService
- Android platform builds prior to the September 2026 security patch level
- Android device vendors distributing builds before the 2026-09-01 patch
Discovery Timeline
- 2026-09-08 - CVE-2026-45528 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-45528
Vulnerability Analysis
The vulnerability is classified as an Improper Export of Android Application Components issue [CWE-926] and enables a well-known LaunchAnyWhere attack pattern. The getManageSpaceActivityIntent method in StorageManagerService.java returns a PendingIntent intended to launch an application's manage-space activity. Because the returned intent is not sufficiently constrained, a local attacker can mutate its target before it fires. When a privileged component later triggers the PendingIntent, the resolved activity runs with the identity and privileges of that system process. This provides a path from a locally installed app with limited privileges to full local escalation of privilege.
Root Cause
The root cause is an unsafe PendingIntent construction. The intent is created without the necessary immutability flag (FLAG_IMMUTABLE) or with an under-specified base intent that allows key fields such as the component, action, or data to be overwritten by a recipient. Android's PendingIntent model preserves the creator's identity, so any modified intent still executes with the privileges of the system_server process that produced it.
Attack Vector
Exploitation requires local code execution through a malicious application and a user interaction step, such as tapping a crafted dialog or storage-management prompt. The malicious app requests the PendingIntent from StorageManagerService, then supplies an intent that overrides the component to a target activity of the attacker's choosing. When the framework fires the intent, the target activity launches with system-level privileges, allowing the attacker to reach otherwise protected components. There are no public exploits or Known Exploited Vulnerabilities Catalog entries associated with this CVE at publication.
No verified proof-of-concept code is available. Technical details are documented in the Android Security Bulletin September 2026.
Detection Methods for CVE-2026-45528
Indicators of Compromise
- Unexpected launches of privileged Settings or Storage activities initiated by non-system UIDs.
- Applications repeatedly calling getManageSpaceActivityIntent or manipulating storage-related PendingIntent objects.
- Newly installed applications requesting broad storage permissions immediately before privileged UI transitions.
Detection Strategies
- Audit installed applications for API calls that consume storage-management PendingIntent objects and mutate intent components before invocation.
- Correlate logcat entries from StorageManagerService with subsequent activity launches attributed to system_server.
- Compare device build fingerprints against the September 2026 Android security patch level to identify unpatched fleet devices.
Monitoring Recommendations
- Ingest Android device logs into a centralized analytics platform and alert on privileged activity launches originating from third-party packages.
- Track mobile threat defense telemetry for applications exhibiting intent-redirection behavior consistent with LaunchAnyWhere exploitation.
- Monitor enterprise mobility management (EMM) compliance dashboards for devices below the required September 2026 patch level.
How to Mitigate CVE-2026-45528
Immediate Actions Required
- Apply the Android security patch level 2026-09-01 or later to all managed devices.
- Restrict installation of untrusted APKs by enforcing Google Play Protect and blocking sideloading via mobile device management policy.
- Instruct users to decline unexpected storage-management prompts from unfamiliar applications until patching is complete.
Patch Information
Google published the fix in the Android Security Bulletin September 2026. Device manufacturers must incorporate the AOSP patch and distribute builds reporting a security patch level of 2026-09-01 or later. Enterprises should confirm carrier and OEM rollouts for each device model in their fleet.
Workarounds
- Enforce EMM policies that restrict installation sources to vetted enterprise or Play Store catalogs.
- Deploy a mobile threat defense agent capable of flagging applications exhibiting intent-manipulation behavior.
- Isolate unpatched devices from sensitive corporate resources until the vendor patch is applied.
# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
