Android CVE-2026-28572

Exploitation requires a malicious application already installed on the target Android 16-QPR2 device with standard user-level privileges (CVSS PR:L). The attack vector is local (AV:L), meaning remote delivery is not possible - the adversary must first convince the victim to install the malicious APK via sideloading, phishing, or third-party app store. The vulnerability triggers in the onCreate lifecycle of InstallLaunch.kt during the package installation activity. Per the CVSS UI:N, no additional user interaction beyond app installation is documented as required, though this is inconsistent with conventional tapjacking mechanics; defenders should verify whether any user-initiated action (such as navigating to install another package) is in practice necessary. No special device configuration, root access, or developer mode is specified as a prerequisite. Exploitation is limited to Android 16-QPR2 and is not automatable per SSVC.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the local attack boundary and low-privilege requirement - exploitation requires only that the adversary's app is installed on the target device, with no special configuration needed. The SSVC rating of Technical Impact: total is consistent with the C:H/I:H/A:H triad and represents the worst-case outcome if a malicious app successfully hijacks the installer flow. The stated UI:N is notable and somewhat atypical for tapjacking, which ordinarily involves deceiving a user into tapping a UI element (suggesting UI:R); this inconsistency should be verified against the upstream Android Security Bulletin, as it may indicate the overlay manipulates the installer automatically without requiring any victim touch. Even a mid-sized municipal IT team in zabrze managing a mixed Android fleet can reasonably defer emergency patching in favour of the standard monthly security bulletin cycle, given the EPSS score of 0.11% (2nd percentile) and SSVC Exploitation: none - no observed exploitation infrastructure exists at this time. The combination of local delivery requirement (AV:L) and Automatable: no in SSVC further depresses realistic threat priority relative to the raw CVSS score.

An attacker distributes a malicious Android application, delivered via social engineering or a third-party app store, that is installed on a target device running Android 16-QPR2. When the package installer activity (InstallLaunch.kt) is launched - whether by the victim installing another application or triggered programmatically - the malicious app creates a UI overlay in onCreate that misleads the interface, allowing the attacker's app to silently escalate its privileges or approve installation of an additional payload without the victim's informed consent. No public proof-of-concept has been identified at time of analysis.