Executive brief
Android's LauncherAppsService handles background activity launching. A flaw in the Background Activity Launch (BAL) permission check allows a local app to launch activities from the background without proper authorization. An attacker with a malicious app can escalate privileges on an affected Android device with no user interaction required.
Technical details
This vulnerability is a privilege escalation (EoP) flaw in buildIntentSenderForUser of LauncherAppsService.java, stemming from improper validation of Background Activity Launch (BAL) restrictions. The vulnerable code fails to correctly enforce BAL policy when processing intent sender requests, allowing a local attacker (malicious app) to bypass background activity launch restrictions. The attack requires no additional execution privileges and no user interaction. An attacker can exploit this to launch arbitrary activities in the background, potentially gaining elevated permissions or triggering unauthorized actions. Patches are available in Android 16, 16-qpr2, and 17.
Affected products
- Google Android 14, 15, 16 (prior to 16-qpr2), 17 (prior to patch)
Timeline
- 2026-09-08: disclosed: Android Security Bulletin September 2026
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue