CVE-2026-28614: Security vulnerability
In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Event History
Frequently Asked Questions
Does exploitation require user interaction or pre-existing execution privileges?
No user interaction is needed. The available information also states that no additional execution privileges are required for exploitation.
Is this characterized as a remote or local issue?
This is characterized as a local escalation-of-privilege issue. The provided information does not describe a remote attack path.
What code path should be reviewed when assessing exposure?
The issue is identified in the onCreate method of SlicePermissionActivity.java and involves a confused-deputy permission bypass.
Are affected versions or configuration-based workarounds identified?
No affected versions, default-configuration status, or temporary mitigations are provided in the available information.