CVE-2026-28644: Elevation of privilege in Google Android

This vulnerability involves a permission bypass in the startNextMatchingActivity method within ActivityTaskManagerService.java in Google Android. The flaw is caused by a confused deputy problem that allows a local attacker with limited privileges to escalate their privileges without needing further execution rights or user interaction. The CVSS 3.1 base score is 7.8, indicating a high severity with impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to local privilege escalation, granting an attacker higher privileges on the affected Android device. This can compromise the confidentiality, integrity, and availability of the system. No user interaction is required, increasing the risk of automated or stealthy attacks. However, exploitation requires local access with some privileges.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit local access to trusted users and monitor for suspicious activity related to privilege escalation attempts.