Junglewise Threat Intelligence

CVE-2026-28644: Android Framework permission bypass in ActivityTaskManagerService

CVE-2026-28644 · Severity: high · CVSS 7.8 · Published 2026-09-08

Executive brief

Android's ActivityTaskManagerService handles the launching of activities on Android devices. A permission bypass vulnerability allows a local attacker to escalate privileges without requiring additional permissions or user interaction, potentially gaining elevated access to the device.

Technical details

The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java and is caused by a confused deputy vulnerability. This allows an attacker to bypass permission checks and achieve local escalation of privilege (EoP). The attack is local in nature and requires no additional execution privileges or user interaction. Patches have been released to AOSP for Android versions 14, 15, 16, 16-qpr2 as indicated in the security bulletin.

Affected products

  • Google Android 14, 15, 16, 16-qpr2

Timeline

  • 2026-09-08: disclosed
  • 2026-09-08: patched

References

Related threats