CVE-2026-28650

CVE-2026-28650 is a logic error in setHiddenWhileSuspended in Android's WindowState.java (the window manager framework) that allows windows that should be hidden while an app is suspended to remain visible, producing an overlay bypass. A local app can trigger the flawed code path without needing any additional permissions and without any user interaction. By drawing an overlay the system was supposed to suppress, an attacker can achieve local escalation of privilege on the device. All Android devices running framework versions containing the flawed code are potentially affected; the exact affected version range was not specified in the source data. No public proof of concept, no CISA KEV listing, and a low EPSS score (0.1%, 3rd percentile) indicate that exploitation is not currently known to be occurring.

What to do: Install the latest Android security updates from your device vendor/OEM once they include the fix for CVE-2026-28650, and verify the device's security patch level against the Android Security Bulletin entry for this CVE. As an interim mitigation, restrict the 'Display over other apps' (SYSTEM_ALERT_WINDOW) permission to trusted applications and audit which installed apps can draw overlays. Given no known public PoC or in-the-wild exploitation, this can be handled through your normal patching cadence.