Android CVE-2026-28599

Requires a malicious app installed on the target device with standard low-privileged user-space permissions (CVSS AV:L/PR:L) - this is the primary gating condition. No root access, special Android permissions, or elevated account privileges are needed beyond successful app installation. No user interaction is required after the app begins execution (UI:N). The vulnerable code path in addCreatorToken is part of the default Android runtime on affected versions (Android 16, 17, 16-QPR2) and requires no non-default configuration to trigger. Remote network exploitation is not possible without a separate initial-access vector to deliver and install the app; exploitation is strictly bounded to on-device actors.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterises a local privilege escalation that requires only a low-privileged installed app with no user interaction after installation; attack complexity is low, meaning the logic error is straightforward to exploit once understood. Despite these conditions, EPSS at 0.13% (3rd percentile) signals minimal observed or predicted exploitation, and the CVE is absent from CISA KEV. No POC is publicly available. Real-world risk is bounded by the on-device constraint - an attacker must first deliver and install a malicious app (AV:L/PR:L), which eliminates remote mass exploitation but makes this a meaningful threat in targeted attacks, stalkerware delivery chains, and enterprise MDM bypass scenarios. Android 16 and 17 are recent versions with growing device deployment; the QPR2 variant confirms active quarterly-release channels are affected, meaning unpatched devices will accumulate over time.

An attacker distributes a malicious app via sideloading, a third-party marketplace, or a compromised supply chain, which once installed with standard low-privileged app permissions exploits the addCreatorToken logic error in ActivityManagerService to forge or redirect an Intent's creator token. By impersonating a trusted creator identity, the app redirects an Intent to a protected system component - such as a privileged service or content provider - that trusts the spoofed token, granting the attacker full confidentiality, integrity, and availability impact on the device without any further user interaction.