CVE-2026-28612 in Android
Summary
by MITRE • 09/08/2026
In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified within the resolveActivity method of ActivityStarter.java represents a critical logical flaw that facilitates Intent Redirection attacks, a class of security issues prevalent in Android application development and system services. This specific defect arises from an improper validation or handling of intent data during the activity resolution process, allowing an attacker to manipulate the target component that receives the broadcast or launched intent. In standard secure implementations, the system must strictly verify that the resolved activity is both valid and authorized for the requesting context. However, due to this logic error, the framework fails to adequately restrict where intents can be directed, effectively bypassing intended security boundaries. This flaw enables an attacker to redirect sensitive operations or data to maliciously crafted components under their control, rather than the legitimate target application component originally specified by the system or user action.
The operational impact of this vulnerability is severe, primarily due to its potential for local privilege escalation without requiring additional execution privileges from the attacker. In many Android architectures, certain activities within ActivityStarter handle privileged operations that require higher permissions than those held by standard third-party applications. By exploiting the intent redirection flaw, an unprivileged application can trick these high-privilege components into processing data or executing commands intended for legitimate users. This bypasses the normal permission checks because the malicious app is not directly invoking the protected activity but rather causing the system to launch it on its behalf through a manipulated redirect path. Consequently, this allows the attacker to perform actions such as accessing private user data, modifying system settings, or initiating financial transactions without explicit consent or elevated permissions, effectively achieving privilege escalation from an untrusted context to a trusted one.
User interaction is not required for exploitation, which significantly increases the risk profile of this vulnerability. Many intent redirection flaws require some form of social engineering or physical access to trigger, but in this case, the logic error can be triggered programmatically by any application with minimal permissions that can send broadcasts or implicit intents. This means that a malicious app installed on the device could silently exploit this flaw in the background while the user is engaged in other tasks. The lack of required user interaction makes it particularly dangerous for malware distribution and persistent compromise, as the attack vector does not rely on tricking the user into clicking a link or approving a dialog box. Instead, it relies purely on the structural weakness within the Android framework's activity resolution logic, allowing automated exploitation tools to leverage this flaw consistently across different devices running affected versions of the operating system.
From an industry standards perspective, this vulnerability aligns closely with CWE-913, which describes Improper Control of Dynamically-Managed Code Resources, specifically regarding the manipulation of control flow through intent redirection. It also maps to ATT&CK technique T1059, Command and Scripting Interpreter, as well as T1621, Permission Group Discovery, depending on how the redirected activity is utilized by the attacker. The core issue lies in the failure to enforce strict origin validation and target component verification during the intent resolution phase. To mitigate this risk, developers and system integrators must ensure that all activities involved in sensitive operations implement explicit package name checks or signature-based verifications when receiving intents. Additionally, utilizing exported=false for internal-only activities prevents external apps from interacting with them entirely. For existing deployments, applying vendor-provided security patches is essential to correct the logic error within ActivityStarter.java and restore proper intent routing controls.