CVE-2026-28572

CVE-2026-28572 is a tapjacking/overlay weakness in the onCreate handler of InstallLaunch.kt in the Android open-source project (assigned CWE-601 in the CVE record), where an overlay drawn by another app on the device can present a misleading UI during the package install/launch flow. A malicious app already running locally on the device can obscure or manipulate the install UI with an overlay; notably, the CVE record states that user interaction is not required for exploitation, so the attacker does not need the victim to tap anything. Successful abuse enables local escalation of privilege with no additional execution privileges needed, consistent with the high confidentiality, integrity, and availability impact in the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, score 7.8). Potentially affected are Android devices running the affected AOSP component; the available data does not specify which Android version ranges are impacted. No public proof-of-concept is known, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS assigns roughly a 0.1% probability of exploitation within 30 days, so no active exploitation is currently documented.

What to do: Monitor the Google/Android security bulletin for the patched release and affected version ranges, and apply Android monthly security updates promptly once published. In the interim, audit installed apps holding the 'Display over other apps' (SYSTEM_ALERT_WINDOW) permission and revoke it for untrusted or sideloaded apps, since overlay capability is the core of this attack. Enterprise administrators should enforce managed patching and app-install policies on corporate devices and treat unmanaged Android endpoints as higher residual risk until patched.