CVE-2026-28599

CVE-2026-28599 is a logic error in the addCreatorToken function of Android's ActivityManagerService that allows an intent redirection protection to be bypassed (CWE-693, protection mechanism failure). A local attacker, such as a malicious app already running on the device, can trigger the flaw without any user interaction and without needing any additional privileges. Successful exploitation yields local escalation of privilege, with high impact on confidentiality, integrity and availability because the attacker gains capabilities beyond the app's intended sandbox. The flaw affects Android; the affected version range is not specified in the available data, so defenders should consult the Android Security Bulletin entry for the affected and patched builds. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known, and EPSS assigns only a 0.1% probability of exploitation within 30 days.

What to do: Install the Android security update that addresses CVE-2026-28599 as soon as it reaches your device via the OEM (check Settings > System > System update) and enable automatic updates; enterprises and OEMs should track the Android Security Bulletin entry for patched AOSP branches. Because exploitation requires a local attacker with no user interaction, restricting app installs to trusted sources is the primary containment measure until patched.