CVE-2026-28572 Google CVE debrief

Who should care

Android system administrators and security teams should assess exposure and verify patching to mitigate potential risks. Additionally, operators and platform administrators may need to review and apply security updates to affected systems. Vulnerability management and security teams should also review the vulnerability and assess its potential impact on their systems and operations.

Why it matters

CVE-2026-28572 is a high-severity vulnerability in Android's InstallLaunch.kt, potentially allowing local escalation of privilege. Android system administrators and security teams should assess exposure, verify patching, and apply security updates to mitigate potential risks.

• Local escalation of privilege requires verification from official sources
• Potential for tapjacking/overlay attacks needs assessment and mitigation
• Verification of patching and security updates is necessary

Technical summary

The vulnerability exists in the onCreate function of InstallLaunch.kt, potentially leading to local escalation of privilege without additional execution privileges needed. User interaction is not needed for exploitation. The vulnerability could allow attackers to perform actions on behalf of users without their knowledge, leading to privilege escalation. Official sources, including the CVE Program and NIST NVD, have assessed the vulnerability and provided detailed information on its severity and potential impact.

Defensive priority

Assess exposure and verify patching for Android installations.

Recommended defensive actions

• Assess exposure and verify patching for Android installations
• Review and apply security updates for affected systems
• Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, with a CVSS score of 7.8 and HIGH severity. Evidence from official sources indicates that this vulnerability exists in the onCreate function of InstallLaunch.kt. The vulnerability has been assessed by official sources, including the CVE Program and NIST NVD, which have provided detailed information on its severity and potential impact. However, the exact scope of affected systems and components is not explicitly stated,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.