CVE-2026-28663

CVE-2026-28663 is a background activity launch (BAL) bypass in buildIntentSenderForUser of Android's LauncherAppsService, an incorrect-authorization flaw (CWE-863) that allows an activity to be started from the background when that should not be permitted. A malicious app already on the device can trigger the flawed intent-sender construction to launch components without user interaction and without needing any additional execution privileges. An attacker gains local escalation of privilege, using the bypass to act outside the permissions normally granted to a background app, with high impact on confidentiality, integrity, and availability. All Android devices running builds that include the vulnerable LauncherAppsService code are potentially affected, although the source data does not specify affected version ranges. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known, and EPSS estimates only about a 0.1% chance of exploitation in the next 30 days.

What to do: Install the Android security update addressing CVE-2026-28663 as it reaches your device via the monthly security patch from Google or your device OEM. Until patched, limit installation of untrusted apps, since exploitation requires a malicious local app but no user interaction. No workarounds or public exploits are documented at this time.