Android CVE-2026-28644

The attacker must have the ability to execute code on the target Android device as a low-privileged user - specifically, a user-installed application with standard (non-elevated) permissions must be running. This maps to CVSS PR:L. Exploitation is local only (AV:L); remote exploitation without pre-existing code on device is not supported by this vulnerability. No user interaction is required once the malicious app is executing (UI:N). The flaw applies to Android 14, 15, 16, and 16-QPR2 regardless of specific device configuration, but the attacker must already have an installed application on the target - drive-by exploitation from network or web vectors is not applicable. Devices patched to the 2026-09-01 Android Security Patch Level are not affected.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a local attack with low complexity and low privilege requirements, yielding a base score of 7.8 and total CIA impact on the device. Despite this elevated base score, the EPSS probability of exploitation is very low at 0.12% (2nd percentile), and SSVC confirms Exploitation status as 'none' with Automatable set to 'no', indicating this is not a trivially scriptable or mass-exploitable class - even a mid-sized municipal IT team in radom managing an Android fleet should treat this as important but not immediately emergency-tier. CISA KEV listing is absent and no public proof-of-concept has been identified. The technical impact is rated 'total' by SSVC, confirming that successful exploitation fully compromises the device. The discrepancy between the low EPSS and high CVSS is consistent with a vulnerability that is mechanically impactful but requires an attacker to already have installed code on a target device. Real-world risk is moderate: elevated for high-value targets where malicious apps may already be present, lower in environments with enforced application whitelisting.

An attacker distributes a malicious Android application that, once installed on a victim device with default permissions, calls startNextMatchingActivity with a crafted intent to exploit the confused deputy condition in ActivityTaskManagerService. The system service, acting on behalf of the caller without adequately enforcing permission checks, performs a privileged activity-launch operation the calling app is not authorized to execute. No public proof-of-concept exploit has been identified at time of analysis, but the mechanical simplicity of intent-based exploitation reduces the barrier for skilled adversaries.