CVE-2026-28612

CVE-2026-28612 is a logic error in the resolveActivity function of ActivityStarter.java in the Android framework that permits Intent Redirection attacks, where a crafted intent is resolved and launched with more privileges than the caller should have. Triggering requires only locally installed code on the device, with no additional execution privileges and no user interaction needed. A successful exploit yields local escalation of privilege, allowing an attacker to run code with elevated system-level permissions on the affected device. All Android devices running unpatched framework builds are potentially affected; the source data does not specify affected or fixed version ranges, so users should consult the Android Security Bulletin for their device. There is no evidence of exploitation so far: the flaw is not in CISA's KEV catalog, no public proof-of-concept is known, and EPSS estimates only a ~0.1% chance of exploitation in the next 30 days.

What to do: Install Android security updates as soon as they are offered via Settings > System > System update, and check with your device manufacturer for the specific security patch level addressing this CVE. Since exploitation requires locally installed code, avoid installing apps from untrusted sources while awaiting the patch. Verify your device's current Android security patch level to confirm it includes the fix.