Android CVE-2026-28614

Exploitation requires that the attacker control a low-privileged application already installed on the target Android device - this is the PR:L prerequisite in the CVSS vector and the binding local access constraint (AV:L). The confused deputy is triggered through a crafted intent directed at SlicePermissionActivity.java's onCreate method; no special system configuration or feature enablement beyond the default Android Slice framework is stated as a prerequisite. No user interaction is required after the malicious app is installed (UI:N). Exploitation is limited by: (1) the attacker must have a pathway to install an app on the target device, whether through physical access, social engineering to sideload, or a compromised distribution channel; (2) SSVC rates this as non-automatable, ruling out mass remote exploitation; (3) the attack is strictly local and cannot be triggered remotely without a prior installation-level foothold.

The CVSS 7.8 score with AV:L/PR:L is calibrated appropriately for a local Android LPE: network exploitation is not possible, and a malicious app must already be installed. EPSS at 0.12% (2nd percentile) indicates very low observed exploitation probability in the wild. SSVC corroborates this - Exploitation: none, Automatable: no - meaning mass or opportunistic remote exploitation is not feasible at this time. However, SSVC Technical Impact is rated 'total', consistent with the C:H/I:H/A:H vector: a successful exploit grants an attacker full control over the device's data, integrity, and availability. The breadth of affected versions (Android 14 through 17) is notably wide, covering the current production Android ecosystem and increasing aggregate exposure significantly. Even a mid-sized municipal IT team in sanok managing a fleet of Android devices should treat this as part of the standard September 2026 Android patch cycle rather than a deprioritized edge case. The low EPSS and absence from CISA KEV indicate this is not an actively weaponized threat, but the low exploitation complexity (AC:L, no UI) makes it a reliable escalation primitive for a targeted attacker who can install an app on the victim device.

An attacker packages a malicious Android application and delivers it to a target device via sideloading, a third-party app store, or a compromised enterprise MDM channel. Once installed, the app sends a crafted intent to SlicePermissionActivity.java's onCreate handler, exploiting the confused deputy flaw to obtain slice access permissions it was not granted by the user. With these elevated permissions, the attacker's app can access data or functionality belonging to higher-privileged apps, effectively achieving local privilege escalation without requiring any further user interaction.