CVE-2026-28603

CVE-2026-28603 is a confused deputy vulnerability (CWE-441) in assertSafeToStartCustomActivity of AppRestrictionsFragment.java, a component of the Android Settings code assigned by Google's Android security team. A local, low-privileged app can trigger the flaw without user interaction, inducing the Settings component to act on the app's behalf in a way that grants read/write access to private files. An attacker who exploits it gains local escalation of privilege and does not need any additional execution privileges to succeed. Android devices running the affected Settings component are potentially exposed, but the source data does not specify which version ranges are affected. There is no evidence of exploitation in the wild, no known public proof-of-concept, and EPSS currently estimates only a 0.1% chance of exploitation within 30 days.

What to do: Apply the Android security update that addresses CVE-2026-28603 as soon as your OEM or carrier releases it, then confirm the new security patch level in Settings > About phone. Until patched, limit risk by avoiding installation of untrusted local apps, since exploitation requires a malicious local app but no user interaction. The source data does not list fixed versions, so check Google's Android security bulletins for the affected and fixed build ranges.