Executive brief
Google Android's framework component contains a logic error in the activity resolution system that allows an attacker to redirect application intents (requests for operations) to unintended recipients. This vulnerability enables local privilege escalation on Android devices, potentially allowing an attacker with basic app permissions to gain elevated system privileges and compromise the confidentiality and integrity of user data and system operations.
Technical details
CVE-2026-28612 is an elevation of privilege (EoP) vulnerability in the ActivityStarter.java component of Android's framework, caused by a logic error in the resolveActivity method. The vulnerability allows Intent Redirection attacks, which occur when an application's implicit intents are intercepted and rerouted to malicious applications instead of their intended targets. The attack requires no additional execution privileges and no user interaction for exploitation. The flaw affects Android 16, 16-qpr2, and 17; patches have been released to the AOSP repository. A local attacker can exploit this to escalate privileges and gain unauthorized access to sensitive system functions and user data.
Affected products
- Google Android 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: CVE-2026-28612 published in Android Security Bulletin
- 2026-09-05: patched: Security patch level 2026-09-05 and later address this issue; source code patches released to AOSP