Android CVE-2026-28650

Exploitation requires a low-privileged application to be installed and executable on the target Android device (PR:L, AV:L) - this is the foundational prerequisite. The logic error is triggered by the app manipulating its suspend/window state to cause setHiddenWhileSuspended to mishandle the hidden flag. No special Android permissions beyond those available to a standard installed app are described as required, and no user interaction is necessary after the app is running. Exploitation is bounded by: (1) physical or logical access to install an app on the device, (2) the target device running Android 14, 15, 16, 16-qpr2, or 17 without the September 2026 security patch, and (3) the local attack surface - remote or network-based exploitation is not possible per the AV:L vector.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a locally exploitable privilege escalation requiring only a low-privileged installed app and no user interaction, with full CIA impact - even a mid-sized municipal IT team in kalisz managing a large Android device fleet should treat this as a meaningful internal threat given that malicious or compromised apps could silently escalate without any prompt. However, the EPSS score of 0.13% (3rd percentile) and SSVC exploitation status of 'none' substantially temper urgency: real-world weaponization has not been observed as of this analysis. SSVC flags 'not automatable,' consistent with AV:L requiring a locally installed application - mass exploitation via network scanning is ruled out. The gap between SSVC's 'total' technical impact and the very low EPSS score suggests that while the vulnerability is severe in theory, exploitation requires an attacker who already has code-execution capability on the target device, which limits the realistic threat actor pool to post-compromise or sideloaded-app scenarios.

An attacker distributes a malicious Android application - via sideloading or a compromised app distribution channel - to a target device running Android 14 through 17. Once installed and granted minimal permissions, the app triggers the logic error in setHiddenWhileSuspended to keep its overlay window active while suspended, overlaying system UI or other sensitive apps, and leverages that position to capture credentials or inject UI interactions that escalate its effective privilege. No public proof-of-concept has been identified, so exploitation likely requires detailed knowledge of the Android WindowManagerService internals.