CVE-2026-28599 in Android
Summary
by MITRE • 09/08/2026
In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified within the addCreatorToken method of ActivityManagerService.java represents a critical security flaw rooted in flawed logical validation during the creation of activity tokens on Android systems. This specific logic error allows an attacker to bypass intended access controls, facilitating what is classified as Intent Redirection Bypass. In the context of mobile operating system architecture, ActivityManagerService serves as the central authority for managing application components and their lifecycle states. The addCreatorToken function is responsible for validating and registering tokens that determine which applications are permitted to launch or interact with specific activities. When this validation process contains a logical gap, it creates an avenue for unauthorized entities to manipulate how intents are processed and directed within the system.
From a technical perspective, the core issue lies in the insufficient verification of the caller's identity or permissions before granting access privileges associated with activity tokens. Normally, such mechanisms ensure that only authorized applications can initiate specific actions or redirect user interactions to designated targets. However, due to the logic error described, an application lacking proper elevated privileges can exploit this gap to trick the system into treating its requests as if they originated from a higher-privileged source. This effectively neutralizes the security boundaries established by the Android permission model, allowing malicious code to execute actions that should otherwise be restricted based on user consent or app signature verification.
The operational impact of this vulnerability is severe, primarily due to its potential for local privilege escalation. An attacker who can exploit this flaw does not require additional execution privileges beyond what a standard application possesses upon installation. This significantly lowers the barrier to entry for exploitation, as it eliminates the need for complex pre-conditions such as physical access or prior compromise of system-level services. Furthermore, the fact that user interaction is not required for exploitation makes this vulnerability particularly dangerous in real-world scenarios. It enables silent background execution where a malicious application can perform sensitive operations without alerting the user, potentially leading to data exfiltration, unauthorized account takeover, or further lateral movement within the device ecosystem.
This flaw aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying authorization before granting access to resources. Additionally, from a tactical perspective relevant to threat modeling and defense strategies, this vulnerability maps closely to MITRE ATT&CK techniques involving privilege escalation on mobile platforms. Attackers can leverage such flaws as part of an initial access or persistence strategy, using the elevated capabilities gained through intent redirection to install additional malware, steal sensitive information stored in protected directories, or manipulate system settings for persistent control over the device.
Mitigation strategies must focus on rigorous code review and enhanced validation logic within the ActivityManagerService component. Developers should ensure that all token creation processes strictly enforce identity verification against established security policies before granting any privileges. Implementing stricter checks to validate the source of intent requests can prevent unauthorized redirections. For system administrators and users, staying updated with official vendor patches is critical, as these updates typically contain fixes for such logic errors in core system services. Until patched, deploying mobile device management solutions that enforce strict application whitelisting may help reduce the attack surface by limiting which applications are permitted to run on affected devices.