In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

cve CVE-2026-28612 1 source, 1 claim · Watch

NVD writes:
In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. the claim

What it is to other things

affects	google/android NVD
made_by	google NVD

What each source says

Property Source Said Means here

Cvss

cvss

NVD

7.8

receipt

Source: NVD
Its words: 7.8
Read by: field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-02 18:04 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Android",
            "vendor": "Google",
            "versions": [
              {
                "status": "affected",
                "version": "17"
              },
              {
                "status": "affected",
                "version": "16-qpr2"
              },
              {
                "status": "affected",
                "version": "16"
              }
            ]
          }
        ],
        "source": "security@android.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*",
                "matchCriteriaId": "02882AB1-7993-47DD-84A0-8DF4272D85ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*",
                "matchCriteriaId": "9123E1DD-8607-427B-82B9-6E44B96C90F1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*",
                "matchCriteriaId": "E3D15FD9-304E-4270-81C7-C8D9024D457D",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
      }
    ],
    "id": "CVE-2026-28612",
    "lastModified": "2026-09-15T14:17:47.540",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-28612",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-10T03:57:10.484196Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T19:17:53.330",
    "references": [
      {
        "source": "security@android.com",
        "tags": [
          "Vendor Advisory",
          "Patch"
        ],
        "url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01"
      }
    ],
    "sourceIdentifier": "security@android.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-693"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Product

product

NVD

Android

receipt

Source: NVD
Its words: Android
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-02 18:04 UTC
Original: open at the source

2026-09-29 17:49 UTC	Android
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Android",
            "vendor": "Google",
            "versions": [
              {
                "status": "affected",
                "version": "17"
              },
              {
                "status": "affected",
                "version": "16-qpr2"
              },
              {
                "status": "affected",
                "version": "16"
              }
            ]
          }
        ],
        "source": "security@android.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*",
                "matchCriteriaId": "02882AB1-7993-47DD-84A0-8DF4272D85ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*",
                "matchCriteriaId": "9123E1DD-8607-427B-82B9-6E44B96C90F1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*",
                "matchCriteriaId": "E3D15FD9-304E-4270-81C7-C8D9024D457D",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
      }
    ],
    "id": "CVE-2026-28612",
    "lastModified": "2026-09-15T14:17:47.540",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-28612",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-10T03:57:10.484196Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T19:17:53.330",
    "references": [
      {
        "source": "security@android.com",
        "tags": [
          "Vendor Advisory",
          "Patch"
        ],
        "url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01"
      }
    ],
    "sourceIdentifier": "security@android.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-693"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Status

status

NVD

Analyzed

receipt

Source: NVD
Its words: Analyzed
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-02 18:04 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Android",
            "vendor": "Google",
            "versions": [
              {
                "status": "affected",
                "version": "17"
              },
              {
                "status": "affected",
                "version": "16-qpr2"
              },
              {
                "status": "affected",
                "version": "16"
              }
            ]
          }
        ],
        "source": "security@android.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*",
                "matchCriteriaId": "02882AB1-7993-47DD-84A0-8DF4272D85ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*",
                "matchCriteriaId": "9123E1DD-8607-427B-82B9-6E44B96C90F1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*",
                "matchCriteriaId": "E3D15FD9-304E-4270-81C7-C8D9024D457D",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
      }
    ],
    "id": "CVE-2026-28612",
    "lastModified": "2026-09-15T14:17:47.540",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-28612",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-10T03:57:10.484196Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T19:17:53.330",
    "references": [
      {
        "source": "security@android.com",
        "tags": [
          "Vendor Advisory",
          "Patch"
        ],
        "url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01"
      }
    ],
    "sourceIdentifier": "security@android.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-693"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

Google

receipt

Source: NVD
Its words: Google
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-02 18:04 UTC
Original: open at the source

2026-09-29 17:49 UTC	Google
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Android",
            "vendor": "Google",
            "versions": [
              {
                "status": "affected",
                "version": "17"
              },
              {
                "status": "affected",
                "version": "16-qpr2"
              },
              {
                "status": "affected",
                "version": "16"
              }
            ]
          }
        ],
        "source": "security@android.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*",
                "matchCriteriaId": "02882AB1-7993-47DD-84A0-8DF4272D85ED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*",
                "matchCriteriaId": "9123E1DD-8607-427B-82B9-6E44B96C90F1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*",
                "matchCriteriaId": "E3D15FD9-304E-4270-81C7-C8D9024D457D",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
      }
    ],
    "id": "CVE-2026-28612",
    "lastModified": "2026-09-15T14:17:47.540",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-28612",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-10T03:57:10.484196Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T19:17:53.330",
    "references": [
      {
        "source": "security@android.com",
        "tags": [
          "Vendor Advisory",
          "Patch"
        ],
        "url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01"
      }
    ],
    "sourceIdentifier": "security@android.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-693"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}

—

vulnerability

In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

zetlyn/cve-nvd · 2026-09-08

cvss 7.8 product Android status Analyzed vendor Google

source