CVE-2026-28657

CVE-2026-28657 is a confused-deputy flaw (CWE-441) in the onActivityResult handler of Android's AppWidgetConfigActivityProxy, which can result in a content-URI permission being granted to a caller without proper authorization. A local application can trigger the flawed result-handling path to obtain the unintended URI permission grant, with no user interaction and no additional execution privileges required. An attacker who exploits it gains local escalation of privilege on the device, consistent with the high confidentiality, integrity, and availability impact reflected in the 7.8 (High) CVSS 3.1 score. All Android devices running builds that contain the vulnerable component are potentially affected; specific version ranges were not provided in the available data, and the fix is delivered through Android security updates. No exploitation is currently observed: there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.1% probability of exploitation within 30 days.

What to do: Install the Android security bulletin update that addresses CVE-2026-28657 as soon as your device OEM delivers it, and verify fleet security-patch levels via MDM or device settings include this fix. Because exploitation requires only a local app and no user interaction, users on unpatched devices should avoid installing apps from untrusted sources until updated. OEMs should integrate the AOSP patch into their builds promptly.