{"id":"CVE-2026-28599","title":"In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code","summary":"In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-693"],"vendor":"google","product":"android","affected":["android = 16.0","android = 17.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:25:59.723","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28599","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"epss":0.00077,"epssPercentile":0.00144,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:57:04.781834Z"},"ingestedAt":"2026-09-08T19:08:49.643Z","slug":"CVE-2026-28599","body":"## Overview\n\nIn addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 16.0`\n- `android = 17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201507,"id":"CVE-2026-28599","ts":1789399510855,"field":"cvss","old":null,"new":"7.8"},{"seq":201506,"id":"CVE-2026-28599","ts":1789399510855,"field":"severity","old":"none","new":"high"},{"seq":200241,"id":"CVE-2026-28599","ts":1789397086255,"field":"cvss","old":"7.8","new":null},{"seq":200240,"id":"CVE-2026-28599","ts":1789397086255,"field":"severity","old":"high","new":"none"},{"seq":198165,"id":"CVE-2026-28599","ts":1789391739638,"field":"cvss","old":null,"new":"7.8"},{"seq":198164,"id":"CVE-2026-28599","ts":1789391739638,"field":"severity","old":"none","new":"high"},{"seq":195958,"id":"CVE-2026-28599","ts":1789383399345,"field":"cvss","old":"7.8","new":null},{"seq":195957,"id":"CVE-2026-28599","ts":1789383399345,"field":"severity","old":"high","new":"none"},{"seq":194887,"id":"CVE-2026-28599","ts":1789380300375,"field":"cvss","old":null,"new":"7.8"},{"seq":194886,"id":"CVE-2026-28599","ts":1789380300375,"field":"severity","old":"none","new":"high"},{"seq":193674,"id":"CVE-2026-28599","ts":1789378268875,"field":"cvss","old":"7.8","new":null},{"seq":193673,"id":"CVE-2026-28599","ts":1789378268875,"field":"severity","old":"high","new":"none"},{"seq":192461,"id":"CVE-2026-28599","ts":1789376233253,"field":"cvss","old":null,"new":"7.8"},{"seq":192460,"id":"CVE-2026-28599","ts":1789376233253,"field":"severity","old":"none","new":"high"},{"seq":191248,"id":"CVE-2026-28599","ts":1789373126572,"field":"cvss","old":"7.8","new":null},{"seq":191247,"id":"CVE-2026-28599","ts":1789373126572,"field":"severity","old":"high","new":"none"},{"seq":190033,"id":"CVE-2026-28599","ts":1789369120993,"field":"cvss","old":null,"new":"7.8"},{"seq":190032,"id":"CVE-2026-28599","ts":1789369120993,"field":"severity","old":"none","new":"high"},{"seq":188820,"id":"CVE-2026-28599","ts":1789368038314,"field":"cvss","old":"7.8","new":null},{"seq":188819,"id":"CVE-2026-28599","ts":1789368038314,"field":"severity","old":"high","new":"none"},{"seq":187603,"id":"CVE-2026-28599","ts":1789364996485,"field":"cvss","old":null,"new":"7.8"},{"seq":187602,"id":"CVE-2026-28599","ts":1789364996485,"field":"severity","old":"none","new":"high"},{"seq":186390,"id":"CVE-2026-28599","ts":1789363002347,"field":"cvss","old":"7.8","new":null},{"seq":186389,"id":"CVE-2026-28599","ts":1789363002347,"field":"severity","old":"high","new":"none"},{"seq":185176,"id":"CVE-2026-28599","ts":1789360969676,"field":"cvss","old":null,"new":"7.8"},{"seq":185175,"id":"CVE-2026-28599","ts":1789360969676,"field":"severity","old":"none","new":"high"},{"seq":183963,"id":"CVE-2026-28599","ts":1789357943369,"field":"cvss","old":"7.8","new":null},{"seq":183962,"id":"CVE-2026-28599","ts":1789357943369,"field":"severity","old":"high","new":"none"},{"seq":182215,"id":"CVE-2026-28599","ts":1789354097864,"field":"cvss","old":null,"new":"7.8"},{"seq":182214,"id":"CVE-2026-28599","ts":1789354097864,"field":"severity","old":"none","new":"high"},{"seq":181008,"id":"CVE-2026-28599","ts":1789352943330,"field":"cvss","old":"7.8","new":null},{"seq":181007,"id":"CVE-2026-28599","ts":1789352943330,"field":"severity","old":"high","new":"none"},{"seq":179801,"id":"CVE-2026-28599","ts":1789350001037,"field":"cvss","old":null,"new":"7.8"},{"seq":179800,"id":"CVE-2026-28599","ts":1789350001037,"field":"severity","old":"none","new":"high"},{"seq":178594,"id":"CVE-2026-28599","ts":1789347814281,"field":"cvss","old":"7.8","new":null},{"seq":178593,"id":"CVE-2026-28599","ts":1789347814281,"field":"severity","old":"high","new":"none"},{"seq":177387,"id":"CVE-2026-28599","ts":1789346181678,"field":"cvss","old":null,"new":"7.8"},{"seq":177386,"id":"CVE-2026-28599","ts":1789346181678,"field":"severity","old":"none","new":"high"},{"seq":176180,"id":"CVE-2026-28599","ts":1789342751969,"field":"cvss","old":"7.8","new":null},{"seq":176179,"id":"CVE-2026-28599","ts":1789342751969,"field":"severity","old":"high","new":"none"},{"seq":175964,"id":"CVE-2026-28599","ts":1789342358473,"field":"cvss","old":null,"new":"7.8"},{"seq":175963,"id":"CVE-2026-28599","ts":1789342358473,"field":"severity","old":"none","new":"high"},{"seq":175504,"id":"CVE-2026-28599","ts":1789338389973,"field":"cvss","old":"7.8","new":null},{"seq":175503,"id":"CVE-2026-28599","ts":1789338389973,"field":"severity","old":"high","new":"none"},{"seq":174299,"id":"CVE-2026-28599","ts":1789334604690,"field":"cvss","old":null,"new":"7.8"},{"seq":174298,"id":"CVE-2026-28599","ts":1789334604690,"field":"severity","old":"none","new":"high"},{"seq":173094,"id":"CVE-2026-28599","ts":1789333197386,"field":"cvss","old":"7.8","new":null},{"seq":173093,"id":"CVE-2026-28599","ts":1789333197386,"field":"severity","old":"high","new":"none"},{"seq":171908,"id":"CVE-2026-28599","ts":1789330884424,"field":"cvss","old":null,"new":"7.8"},{"seq":171907,"id":"CVE-2026-28599","ts":1789330884424,"field":"severity","old":"none","new":"high"}]}