Android CVE-2026-28636

The attacker must have a malicious application already installed on the target device operating with standard low-privilege user-level permissions (CVSS PR:L). The exploit targets the setupLayout method of PickActivity.java - a code path present in default Android installations on versions 14, 15, 16, and 16-QPR2 with no special configuration required. Exploitation is constrained to local context (CVSS AV:L), meaning an attacker cannot trigger this remotely without a separate initial-access vector such as a malicious app delivery chain. No user interaction is required (CVSS UI:N) once the malicious app is executing. Devices that have applied the 2026-09-01 Android security patch level are not affected.

The CVSS 7.8 High rating with AV:L/AC:L/PR:L/UI:N reflects a locally exploitable flaw requiring only a standard installed application - a realistic attacker position achievable through social engineering or a benign-appearing store submission. Despite the high severity score, real-world exploitation probability is currently very low: EPSS places this at just 0.12% (2nd percentile), and SSVC confirms exploitation status as 'none' and 'not automatable,' indicating no observed threat activity or trivially scalable attack path. Even a mid-sized municipal IT team in kalisz managing a corporate Android fleet should treat this as a priority patch cycle item rather than an emergency, given the 'total' SSVC technical impact rating and the full CIA compromise achievable once exploited. The non-automatable SSVC rating likely reflects that the confused deputy exploit requires specific intent-crafting interactions rather than a mass, worm-style propagation vector. No CISA KEV listing exists and no public POC has been identified, which moderates immediate urgency; however, the unusually broad affected surface - all currently-supported Android versions - warrants expedited patching on managed device fleets.

A malicious application already installed on the target device - potentially delivered via social engineering or a trojanized Play Store submission - crafts a specially constructed intent targeting PickActivity's setupLayout, exploiting its confused deputy relationship to cause Android's privileged installer to process an APK installation without enforcing the 'Install unknown apps' user consent gate. The attacker's app then silently installs a second-stage payload with elevated capabilities such as accessibility services, device admin rights, or additional permissions, achieving persistent privilege escalation. No user interaction is required once the malicious application is executing on device.