CVE-2026-28636: Security vulnerability
Published Sep 8, 2026
·Updated
In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Event History
Sep 8, 2026
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The issue is a local elevation-of-privilege vulnerability and requires no additional execution privileges. Exploitation does not require user interaction.
2
Which security control can be bypassed?
The vulnerability can bypass the "Install unknown apps" security restriction through a confused-deputy condition in PickActivity.java.