CVE-2026-28636

CVE-2026-28636 is a confused-deputy flaw (CWE-441) in the setupLayout function of PickActivity.java in Android, allowing an unauthorized bypass of the 'Install unknown apps' security restriction. A low-privileged local attacker (e.g., an app already running on the device) can trigger the bypass without any user interaction and without needing additional execution privileges. Successful exploitation results in local escalation of privilege, letting the attacker sidestep the gate that normally requires explicit user consent before installing apps from unknown sources. All Android devices that include the affected component are potentially affected; Google has not specified exact affected version ranges in the available data. There are currently no known public proof-of-concepts, no in-the-wild exploitation, and the flaw is not in CISA's KEV, with EPSS estimating only a 0.1% chance of exploitation in the next 30 days.

What to do: Apply the latest Android security patch level as soon as Google publishes the bulletin entry for CVE-2026-28636 (via device OTA updates or enterprise MDM push), since no specific fixed version is listed in the available data. Until patched, review and restrict which apps hold the 'Install unknown apps' (sideloading) permission and consider blocking sideloading for managed devices. Given no known PoC or in-the-wild exploitation, standard monthly patch cadence is currently sufficient.