Android CVE-2026-28631

Exploitation requires a malicious application to be locally installed on the target Android device with at least low-level permissions (AV:L/PR:L per CVSS). The attack specifically targets Android's cross-profile intent-forwarding consent flow in buildMiniResolver, making devices configured with both personal and managed work profiles (Android Enterprise deployments) the most directly exposed. The description explicitly states 'User interaction is not needed,' meaning the attacker does not need to trick the victim into tapping anything - the bypass is mechanically triggered by the overlay at the framework level. Factors that limit exploitation: (1) the attacker must have already achieved initial app installation on the device, via sideloading, social engineering, or a preceding compromise; (2) the attack is not remotely automatable (SSVC Automatable=no; requires on-device execution); (3) exploitation is bounded to Android 14-17 prior to the September 2026 SPL. Devices without work profiles configured have a reduced but not eliminated attack surface, as IntentForwarderActivity may still be exercised in other cross-profile contexts.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) establishes a local attack surface requiring only a low-privilege installed application, but with full C/I/A impact once exploited. The UI:N metric is notable and somewhat atypical for tapjacking - classical tapjacking usually involves tricking a user into clicking, whereas UI:N suggests the bypass is mechanically driven against the framework without requiring explicit victim interaction beyond the malicious app already running. SSVC rates Technical Impact as 'total' (consistent with full C:H/I:H/A:H) but Automatable as 'no,' which aligns with AV:L (on-device installation prerequisite prevents remote mass exploitation). EPSS at 0.12% (2nd percentile) is very low, consistent with the absence of public exploit code and no CISA KEV listing. Real-world priority is elevated for enterprise Android deployments using managed work profiles, where cross-profile intent forwarding is actively exercised; for consumer devices without work profiles, the directly exploitable attack surface is reduced. The combination of high technical impact and low exploitation barrier (AC:L, PR:L) once an app is installed makes this a meaningful lateral movement or privilege escalation vector in a broader attack chain.

An attacker distributes a malicious Android application (sideloaded or via a secondary compromise vector) onto a target device running Android 14-17. Once the app is installed and running with low-level permissions, it draws a transparent overlay window timed to appear over the buildMiniResolver consent dialog when a cross-profile intent is triggered. The framework registers what it interprets as user consent, forwards the cross-profile intent without genuine authorization, and the malicious application gains elevated access across the personal/work profile boundary achieving full C:H/I:H/A:H impact.