CVE-2026-28603: Security vulnerability
Published Sep 8, 2026
·Updated
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Event History
Sep 8, 2026
CVE Published
via MITRE·06:04 PM
Data Sourced
via MITRE·06:04 PM
DescriptionWeakness
Frequently Asked Questions
1
What does an attacker need before exploiting this issue?
The issue is described as a local escalation of privilege and requires no additional execution privileges.
2
Is user interaction required for exploitation?
No. Exploitation does not require user interaction.
3
What access could successful exploitation provide?
Successful exploitation could allow read and write access to private files through a confused-deputy condition.