Android CVE-2026-28657

A malicious application must be installed on the target device running Android 16-QPR2 or Android 17 - the attack vector is local (AV:L) and requires only the privilege level of a regular installed application (PR:L per CVSS). No user interaction is required after installation (UI:N). The attack is not automatable (SSVC), meaning it requires deliberate triggering of the AppWidget configuration flow rather than passive exploitation. Exploitation is limited to the two confirmed affected Android versions; devices already patched with the September 2026 bulletin are not vulnerable. The key limiting factor is physical or social-engineering access to get a malicious app installed on the target device.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is broadly appropriate: the attack vector is genuinely local (requires an installed app, PR:L), complexity is low once an app is in place, and no user interaction is required. The vendor-assigned C:H/I:H/A:H may slightly overstate impact - URI permission escalation in Android primarily affects confidentiality and integrity via content provider access, while the availability component (A:H) is less obviously justified by a permission-grant flaw alone. EPSS at 0.12% (2nd percentile) and SSVC 'Exploitation: none' are consistent with no observed in-the-wild exploitation. However, SSVC 'Technical Impact: total' and 'Automatable: no' indicate that while the flaw is serious in principle, it requires deliberate setup and is not spray-exploitable. Overall, this is a medium-priority patch-cycle item for most organizations - urgent patching is warranted for high-value consumer device deployments, but not an emergency response trigger absent active exploitation signals.

An attacker distributes a malicious Android app - perhaps via a third-party store or social engineering - that, once installed on a target Android 16-QPR2 or Android 17 device, initiates an AppWidget configuration flow through AppWidgetConfigActivityProxy. The app exploits the confused deputy in onActivityResult to capture URI permissions delegated to the proxy, gaining read/write access to content provider URIs (such as contacts, media, or documents) that the app's declared permissions would not normally allow. No public proof-of-concept has been identified at time of analysis.