Android CVE-2026-28612

The attacker must achieve installation of a malicious application on the target Android device; the app requires only standard user-level privileges (PR:L) - no root, device administrator rights, or special permissions are needed prior to exploitation. No non-default configuration or specific hardware state is required beyond the presence of the malicious app and a vulnerable Android version (16, 16-QPR2, or 17). After installation, no further user interaction is needed (UI:N), meaning the exploit can execute autonomously. Exploitation is bounded to the local attack surface (AV:L); the vulnerability cannot be triggered remotely over a network without a pre-existing foothold. Devices running Android versions prior to 16 or patched to the 2026-09-01 SPL or later are not affected by this specific flaw.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N accurately characterizes the attack surface: a local malicious application with standard user privileges can exploit the flaw without any post-installation user interaction, achieving full C:H/I:H/A:H impact. The low EPSS score of 0.12% (2nd percentile) reflects very limited observed exploitation activity, which is consistent with the local attack vector constraining mass Internet-based targeting. No CISA KEV listing and no known public POC have been identified, further signaling that exploitation is not currently widespread. Despite the low exploitation signals, the AV:L/AC:L/UI:N combination means the attack is mechanically straightforward once the malicious app is present on a device - any organization managing a mobile device fleet running Android 16 or 17 without enforced minimum security patch levels should prioritize remediation, as the absence of user interaction after installation makes this difficult to detect or prevent at the endpoint layer alone. The S:U scope indicates no cross-device or cross-account amplification, keeping the blast radius contained to the individual device.

An attacker distributes a malicious Android application through a third-party app store, phishing link, or enterprise sideloading channel and convinces a user to install it. Once installed and granted standard user permissions, the app exploits the logic error in resolveActivity to redirect a privileged system Intent to its own component, bypassing Android's inter-component access controls without any further user interaction. This grants the malicious app elevated privileges equivalent to the targeted privileged component, enabling access to sensitive device data, credential stores, or system services. No public POC has been identified at time of analysis.