Executive brief
A logic error in Android's Framework component allows a local app to access session information it shouldn't be able to read, due to a confused deputy vulnerability. An attacker with an installed app can exploit this without any additional privileges to steal sensitive information about active sessions on the device.
Technical details
CVE-2026-28660 is a confused deputy vulnerability in the getAllSessions method of multiple Framework files caused by a logic error in access control validation. The vulnerability allows local apps to read information disclosure due to improper permission checks. The attack requires only the ability to install and run an app on the device; no additional execution privileges or user interaction is needed. An attacker can exploit this to obtain sensitive session data that should be restricted. Patches are available in Android 15, 16, 16-qpr2, and 17 via the Android Security Bulletin of September 2026.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17 (patched in 15, 16, 16-qpr2, 17)
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Patches released for Android 15, 16, 16-qpr2, and 17