Executive brief
Android's Settings application contains a UI vulnerability in the SettingsFragment component that allows an attacker to bypass user confirmation prompts through misleading or insufficient user interface elements. An attacker with local device access can exploit this to escalate privileges without requiring additional permissions or user interaction, potentially gaining unauthorized control over sensitive device settings and functions.
Technical details
CVE-2026-28593 is a UI-based privilege escalation vulnerability in the getItemList method of SettingsFragment.java. The vulnerability stems from insufficient or misleading user interface elements that fail to properly convey the consequences of user actions or fail to require explicit confirmation for sensitive operations. An attacker with local access to the device can bypass these weak UI controls to escalate privileges. This is a local privilege escalation that requires no additional execution privileges, and user interaction is not needed during exploitation. Patches are available in Android 14, 15, 16, 16-qpr2, and 17 via the September 2026 security update (patch level 2026-09-05 or later).
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue