CVE-2026-28644

CVE-2026-28644 is a permission bypass in the startNextMatchingActivity function of ActivityTaskManagerService.java, the Android system-server component that manages activity launching. It is a confused-deputy flaw (CWE-441): a local app can induce the privileged system server to perform an activity launch on its behalf in a way that skips an intended permission check. A local attacker needs no additional execution privileges and no user interaction to trigger it, and can gain local escalation of privilege on the device. Any Android device running affected code is exposed, though the specific affected version ranges are not stated in the available data. Exploitation status is quiet: there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.1% chance of exploitation in the next 30 days.

What to do: Apply Android security patches as soon as your device maker or carrier distributes them, checking the Android Security Bulletin for the release addressing CVE-2026-28644. Because exploitation requires no user interaction and no special permissions, any locally installed app on an unpatched device is a potential trigger, so prioritize updates on managed, BYOD, and high-value fleet devices. Since the flaw is exploitable only locally, standard hardening (limiting app sideloading and untrusted app installs) reduces exposure while patches roll out.