CVE-2026-28600

A confused deputy vulnerability in the onCreate method of PaymentDefaultDialog.java in Android allows the device's default payment app role to be changed by an application running locally on the device. Because user interaction is not required and no additional execution privileges are needed, a low-privileged app already installed on the device can trigger the flaw without any visible prompt to the user. Successful exploitation results in local escalation of privilege, with high impact to the confidentiality, integrity, and availability of the device. All Android devices shipping the affected component are potentially exposed, though the specific affected version ranges are not stated in the available data and should be confirmed via the Android Security Bulletin. As of now there are no known exploits, no public proof-of-concept, and exploitation probability is low (EPSS ~0.1%).

What to do: Apply the patched build as soon as it is distributed via the monthly Android security bulletin (OTA update); verify the device's security patch level after updating. Because exploitation requires a malicious app already running locally on the device, prioritize patching devices that install third-party or sideloaded applications, and check OEM support pages for vendor-specific patch availability.