CVE-2026-28599 Google CVE debrief

Who should care

Android system administrators, security teams, and developers responsible for maintaining and securing Android systems should assess exposure and apply patches. Additionally, operators and platform teams managing Android deployments should review the vulnerability details and verify the patch status for their environments. Vulnerability management and security teams should prioritize patching and monitor system logs for potential exploitation attempts.

Why it matters

CVE-2026-28599 is a high-severity vulnerability in Google Android that could allow for local escalation of privilege with no additional execution privileges needed. Android system administrators and security teams should assess exposure and apply patches.

• Local escalation of privilege could allow attackers to gain elevated access to sensitive data and system functionality
• Intent Redirection Bypass could enable attackers to manipulate system behavior and evade security controls
• No additional execution privileges are needed for exploitation, increasing the attack surface

Technical summary

The vulnerability is caused by a logic error in the addCreatorToken function of ActivityManagerService.java, potentially allowing for an Intent Redirection Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. The affected component is part of the Google Android operating system, and Android system administrators and security teams should assess exposure and apply patches. The vulnerability details indicate that user interaction is not required for exploitation, increasing the attack surface.

Defensive priority

High priority for Android system administrators and security teams to assess exposure and apply patches

Recommended defensive actions

• Assess exposure and apply patches for affected Android versions
• Review and update incident response plans for potential local escalation of privilege
• Monitor system logs for suspicious activity related to Intent Redirection
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. A vendor advisory and patch are available. Android system administrators and security teams should verify the patch status for their deployments and review system logs for potential exploitation attempts. The vulnerability details indicate a logic error in the addCreatorToken function of ActivityManagerService.java, which could lead to an Intent Redirection Bypass and local escalation

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.