CVE-2026-28636: Elevation of privilege in Google Android

This vulnerability in Google Android arises from a confused deputy problem in the setupLayout function of PickActivity.java. It enables an attacker with limited privileges to bypass the security restriction that prevents installation of unknown apps, thereby escalating their privileges locally without needing further execution rights or user interaction. The CVSS 3.1 base score is 7.8, indicating a high severity with high impact on confidentiality, integrity, and availability.

Successful exploitation leads to local privilege escalation, allowing an attacker to bypass the 'Install unknown apps' restriction and potentially install unauthorized applications. This can compromise device confidentiality, integrity, and availability. No user interaction is required, increasing the risk of silent exploitation by a local attacker with limited privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users and monitor for suspicious activity related to app installations.