Android CVE-2026-28607

A malicious application must be installed on the target device with standard user-level privileges (consistent with PR:L in the CVSS vector). The device must be running Android 15, 16, 16-qpr2, or 17 without the September 2026 security patch applied. No user interaction beyond app installation is required (UI:N per CVSS), and no special device configuration or non-default setting is needed (AC:L). Exploitation is strictly local (AV:L) - remote exploitation is not possible without a separate application delivery mechanism. Android's app store review, sideloading controls, and Play Protect serve as the primary real-world limiting factors for a typical consumer threat model.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) indicates that a low-privileged app installed on the local device can reliably trigger full privilege escalation with no user interaction beyond app presence. Despite the high per-device impact, the local attack vector (AV:L) is a meaningful constraint: an attacker must first get a malicious app onto the device, typically via sideloading, social engineering, or compromising a legitimate app. EPSS at 0.12% (2nd percentile) is very low, and the vulnerability is not listed in CISA KEV, indicating no confirmed mass or targeted exploitation at the time of analysis. The 'multiple functions in multiple locations' framing suggests a systemic BAL bypass pattern rather than a single exploitable endpoint, which may complicate patching but does not increase exploitability for a given attacker. For enterprise and government Android fleets with sensitive data, this warrants prompt patching. For consumer devices protected by app store review and sideloading controls, practical risk is moderate.

An attacker distributes a malicious Android application through sideloading or a compromised app store listing. Once installed with standard user privileges on an unpatched Android 15-17 device, the app identifies a privileged Android system service vulnerable to the confused deputy pattern and invokes it to request a background activity launch. The service, acting as an unintended proxy, launches the activity without BAL policy checks applying to the caller, allowing the malicious app to display an overlay or phishing activity and chain into further privilege escalation.