CVE-2026-28642

CVE-2026-28642 is a logic error in the executeRequest method of ActivityStarter.java in the Android framework that permits an improper background activity launch (BAL), bypassing Android's restrictions on starting activities while an app is in the background. A malicious app already installed on the device can trigger it with no additional execution privileges and no user interaction, matching the local, low-privilege attack vector behind the CVSS 3.1 score of 7.8 (High). Successful exploitation enables local escalation of privilege, letting the attacker's app launch components in a privileged context with high impact on confidentiality, integrity, and availability on the affected device. All Android devices running the affected framework versions are potentially exposed; the source data does not specify version ranges, so defenders should consult the Android Security Bulletin from the assigning CNA ([email protected]). No exploitation is currently known: there is no public proof of concept, the flaw is not in CISA's KEV, and EPSS assigns only a 0.1% probability of exploitation within 30 days (2nd percentile).

What to do: Install the Android monthly security update that includes this framework fix as soon as your OEM delivers it, and check the Android Security Bulletin for the affected and patched framework versions. Because exploitation requires a malicious app already on the device and no user interaction, avoid installing untrusted or sideloaded apps on sensitive devices until patched, and verify security patch levels across enterprise Android fleets.