Android CVE-2026-28656

A malicious application must be installed on the target Android device, requiring either user-initiated sideload, a compromised app store, or physical device access. The victim must actively tap a UI element while the malicious overlay is rendered over the DeviceAdminAdd enrollment screen - passive exploitation is not possible. The attack is limited to Android 14, 15, 16, and 16-QPR2; devices with the September 2026 Android SPL applied are not vulnerable. Exploitation is further constrained by the need for PR:L (installed app context) and UI:R (deliberate user tap interaction), making automated or drive-by exploitation infeasible. Devices restricted to Google Play-only installs with Play Protect active have a meaningfully reduced attack surface.

CVSS 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) accurately reflects local attack surface constrained by mandatory user interaction and the need for a pre-installed malicious app, keeping real-world exploitation effort non-trivial. SSVC labels technical impact as total, consistent with device admin privileges enabling MDM-level control, but exploitation is rated none - aligned with 0.12% EPSS and 2nd-percentile ranking. The attack is not automatable (requires socially engineered user tap), which significantly reduces mass-exploitation potential; even a mid-sized municipal IT team in gniezno should treat this as a medium-priority patch rather than an emergency, unless MDM or kiosk Android deployments are in scope. No POC code and no KEV listing further confirm this remains a theoretical or targeted threat at present. The C:H/I:H/A:H impact is realistic if exploitation succeeds - device admin access enables remote wipe, lock, policy enforcement, and app control - but the local+UI:R constraint meaningfully gates that path.

An attacker distributes a seemingly benign application (a game or utility) through a third-party channel or via social engineering. Once installed, the app draws an invisible overlay over the DeviceAdminAdd enrollment confirmation dialog and lures the victim into tapping a fake UI element - for example, a fake 'Continue' button - which in reality confirms granting the malicious app device administrator privileges. With admin rights acquired silently, the attacker app can lock the device, wipe data, enforce restrictive policies, or persist through factory-reset attempts. No public POC exists at time of analysis.