Android CVE-2026-28642

Requires a locally-installed application on the target Android device running Android 14, 15, 16, or 16-qpr2; the installed app needs only standard (PR:L) application-level permissions - no root, no special system permissions, and no elevated access are required beyond what any installed app holds. The attack vector is strictly local (AV:L): the attacker must have already achieved code execution on the device, most practically via a malicious app the user has installed. No user interaction is required after app installation (UI:N per CVSS). Exploitation is limited by the local-only vector (no remote exploitation path), and SSVC's automatable: no designation indicates the specific logic error path in executeRequest may require targeted invocation rather than trivial fire-and-forget triggering across heterogeneous Android builds.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a locally exploitable privilege escalation requiring only standard app-level permissions with no user interaction post-installation, yielding full confidentiality, integrity, and availability compromise. EPSS at 0.12% (2nd percentile) indicates very low current exploitation probability, and the SSVC exploitation status of 'none' corroborates no known active abuse. The SSVC technical impact of 'total' and automatable 'no' suggest that while the consequences are severe if exploited, reliable triggering of the logic error path likely requires some targeting effort. There is no KEV listing and no public POC, so immediate emergency response is not warranted; however, even a mid-sized municipal IT team in sopot managing a fleet of Android devices used for sensitive operations should treat patch deployment as an urgent cycle given the potential for full device compromise with no user interaction. The gap between low EPSS and high CVSS/SSVC impact is explained by the local-only attack vector - Android's ecosystem means most exploitation attempts would require a malicious app to be installed first, which limits automated mass exploitation.

An attacker distributes a malicious Android application - through sideloading or potentially via a third-party marketplace - that, once installed on a victim's device, invokes the vulnerable executeRequest path in ActivityStarter.java to launch a privileged background activity. The application requires no user interaction beyond initial installation and uses only standard app-level permissions to trigger the logic error, ultimately gaining full control over the device's data and functionality. No public proof-of-concept has been identified at time of analysis.