CVE-2026-28600: Security vulnerability
Published Sep 8, 2026
·Updated
In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Event History
Sep 8, 2026
CVE Published
via MITRE·06:04 PM
Data Sourced
via MITRE·06:04 PM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The issue is described as a local escalation of privilege, so exploitation requires local access. No additional execution privileges are needed.
2
Does exploiting this vulnerability require user interaction?
No. The vulnerability description states that user interaction is not needed for exploitation.
3
What is the security impact if exploitation succeeds?
An attacker may be able to change the device's default payment application through a confused-deputy condition, resulting in local privilege escalation.