CVE-2026-28656

CVE-2026-28656 is a tapjacking/overlay vulnerability in Android's DeviceAdminAdd.java — the confirmation screen shown when a user adds a device administrator — caused by improper restriction of rendered UI layers (CWE-1021). An app already installed on the device can draw an overlay over this security-sensitive prompt and trick the user into tapping through it; user interaction is required for exploitation, and the attacker needs no additional execution privileges. A successful attack can lead to local escalation of privilege, with CVSS 3.1 rating the confidentiality, integrity, and availability impact high (7.3). Users of Android devices running builds containing the affected component are exposed; the source data does not specify affected version ranges, so defenders should consult the Android Security Bulletin issued by the Android security team (the assigning CNA). No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.1% chance of exploitation in the next 30 days (2nd percentile).

What to do: Apply the Android security update (monthly system/OEM patch) that includes the fix for CVE-2026-28656 as soon as your device OEM ships it, and check your vendor's bulletin for the exact patched build. As interim mitigation, deny the 'Display/Draw over other apps' (SYSTEM_ALERT_WINDOW) permission to untrusted apps, review Settings → Device admin apps for unexpected administrators, and be cautious when approving device-admin prompts while other apps are on screen.