CVE-2026-28663 Google CVE debrief

Who should care

Android developers, security teams, and administrators responsible for managing Android devices and applications should be aware of this vulnerability. They should assess exposure, apply patches or mitigations as available, and review compensating controls for exposed systems. This vulnerability could allow an attacker to gain elevated access to sensitive data and functionality, potentially leading to unauthorized access and exploitation.

Why it matters

CVE-2026-28663 is a high-severity vulnerability in Google Android that allows local escalation of privilege. Android developers, security teams, and administrators should assess exposure and apply patches or mitigations as available.

• Local escalation of privilege could allow an attacker to gain elevated access to sensitive data and functionality
• Potential for exploitation without user interaction increases the risk of successful attacks
• Successful exploitation could lead to unauthorized access to sensitive data and functionality

Technical summary

The vulnerability exists in the buildIntentSenderForUser function of LauncherAppsService.java, allowing local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. This technical issue arises from inadequate validation of intent senders, potentially enabling unauthorized elevation of privileges on affected Android devices. Android developers should review and update affected Android versions to mitigate this vulnerability. Security teams and administrators should assess exposure and apply patches or mitigations as available.

Defensive priority

Assess exposure and apply patches or mitigations as available.

Recommended defensive actions

• Assess exposure and apply patches or mitigations as available
• Review and update affected Android versions
• Monitor for exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE Program record and NVD vulnerability detail page. The Android Security Bulletin provides additional information. Evidence is limited to publicly available sources and may not reflect the full scope of affected systems or potential impacts. Defenders should verify affected product deployments and assess exposure based on available information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.