Executive brief
Android's System Framework contains a vulnerability in the SetupPassthroughActivity component that allows an attacker to launch arbitrary activities without proper authorization. By exploiting intent redirection, a malicious app can escalate its privileges and perform unauthorized actions on an Android device. This could enable attackers to access sensitive device functionality or user data after tricking a user into interacting with a malicious interface.
Technical details
The vulnerability is an intent redirection flaw in the SetupPassthroughActivity.java file that fails to properly validate or filter intent parameters in its onCreate method. An attacker can craft a malicious intent that redirects to arbitrary activities, bypassing the Framework's access controls. The vulnerability requires local access and user interaction (e.g., clicking a link or opening a malicious app) to trigger, but does not require elevated execution privileges. Successful exploitation leads to local privilege escalation, allowing an attacker to execute code with elevated permissions. Patches have been released in Android security patch levels 2026-09-05 or later.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17 (patched in 2026-09-05+)
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin September 2026