CVE-2026-28613

CVE-2026-28613 is an improper input validation flaw (CWE-20) in the initAppLinkTypeAndIntent function of ChannelImpl.java in the Android framework, where insufficient validation allows an arbitrary intent to be launched. A local attacker — typically a malicious or compromised app already on the device, since no additional execution privileges are required — must get the user to perform an interaction to reach the flawed code path, as user interaction is required for exploitation. If successfully triggered, the flaw yields local escalation of privilege, letting the attacker act with the elevated context of the affected component, with high impact to confidentiality, integrity, and availability reflected in the CVSS 3.1 score of 7.3. All Android devices running unpatched framework builds are potentially affected; the source data does not specify affected version ranges, so defenders should consult the Android Security Bulletin for the affected AOSP branches and corresponding patch level. There is no public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS assigns only a 0.1% probability of exploitation within 30 days (2nd percentile), so no active exploitation is currently known.

What to do: Apply the Android security update that contains the fix for CVE-2026-28613 as soon as it is offered to your device (Settings > System > System update) and verify the device has reached the corresponding Android security patch level listed in the Android Security Bulletin, since this is a framework fix delivered through monthly updates. Until patched, limit installation of apps from untrusted sources, because exploitation requires a locally installed app plus user interaction. Administrators can use MDM tooling to check fleet-wide security patch levels and prioritize updates for high-risk users.