Executive brief
Android's Framework component contains a confused deputy vulnerability that allows an unprivileged local attacker to bypass background activity launch restrictions and escalate privileges. An exploit could allow malicious apps to launch activities in the background without user consent, potentially enabling unauthorized access to device features, data exposure, or malicious operations.
Technical details
This is a confused deputy vulnerability in the Android Framework affecting multiple functions across multiple locations. The vulnerability allows a local attacker to bypass background activity launch restrictions through privilege escalation. The attack vector is local with no additional execution privileges required, and user interaction is not needed for exploitation. The root cause involves improper privilege delegation or context checking in the Framework's activity launch mechanism. Patches are available in Android 15, 16, 16-qpr2, and 17.
Affected products
- Google Android 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched