CVE-2026-28631

CVE-2026-28631 is a possible consent bypass via a tapjacking/overlay attack in buildMiniResolver of IntentForwarderActivity.java in the Android operating system, the component that presents the confirmation (mini resolver) dialog when intents are forwarded across profiles. A malicious app already present on the device can draw an overlay over the consent prompt so that consent is effectively bypassed; exploitation requires no additional execution privileges and, per the advisory, no user interaction. A successful attacker gains local escalation of privilege with high impact on confidentiality, integrity, and availability on the device (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N). Any unpatched Android device carrying the vulnerable code is affected, with exact version ranges defined by the corresponding Android Security Bulletin; real-world exploitability additionally requires a hostile app with overlay capability to be installed on the device. There is currently no known exploitation in the wild, no public proof-of-concept, and EPSS is low at 0.1%, so near-term risk is low.

What to do: Check the Android Security Bulletin entry for CVE-2026-28631 and install the corresponding monthly Android security update on phones/tablets as soon as device vendors ship it; enterprises managing Android fleets (especially work-profile deployments, since the flaw sits in the cross-profile intent-forwarding path) should prioritize patching. As an interim mitigation, audit which apps hold the 'Display over other apps' (SYSTEM_ALERT_WINDOW) permission and avoid installing untrusted apps until devices are updated.