CVE-2026-28626

CVE-2026-28626 is an intent redirection flaw in the onCreate method of SetupPassthroughActivity.java in Android, where the component launches an activity based on intent data that can be manipulated. A local attacker can trigger the flaw by getting a user to interact with a setup-passthrough flow that launches an attacker-influenced activity, resulting in arbitrary activity launch. Successful exploitation leads to local escalation of privilege without requiring any additional execution privileges, with high impact on confidentiality, integrity, and availability. All Android devices running an affected version of the component are potentially exposed, though the source data does not specify the affected version ranges. Exploitation status is currently quiet: no public proof-of-concept, no CISA KEV listing, and a low EPSS score (0.1% probability of exploitation in the next 30 days, 2nd percentile).

What to do: Apply the latest Android security updates as distributed by Google and your device OEM, and confirm your devices' current security patch level against the Android security bulletin for this CVE. Because exploitation requires local access plus user interaction and there is no known exploitation or public PoC, treat this as routine patch-cadence work rather than an emergency; restrict untrusted apps on managed devices as a precaution.