{"id":"CVE-2026-28607","title":"In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy","summary":"In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-441"],"vendor":"google","product":"android","affected":["android = 15.0","android = 16.0","android = 17.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:28:24.783","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28607","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"epss":0.00068,"epssPercentile":0.00033,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:57:08.373609Z"},"ingestedAt":"2026-09-08T19:08:49.643Z","slug":"CVE-2026-28607","body":"## Overview\n\nIn multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 15.0`\n- `android = 16.0`\n- `android = 17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201519,"id":"CVE-2026-28607","ts":1789399510892,"field":"cvss","old":null,"new":"7.8"},{"seq":201518,"id":"CVE-2026-28607","ts":1789399510892,"field":"severity","old":"none","new":"high"},{"seq":200253,"id":"CVE-2026-28607","ts":1789397086297,"field":"cvss","old":"7.8","new":null},{"seq":200252,"id":"CVE-2026-28607","ts":1789397086297,"field":"severity","old":"high","new":"none"},{"seq":198177,"id":"CVE-2026-28607","ts":1789391740519,"field":"cvss","old":null,"new":"7.8"},{"seq":198176,"id":"CVE-2026-28607","ts":1789391740519,"field":"severity","old":"none","new":"high"},{"seq":195970,"id":"CVE-2026-28607","ts":1789383399386,"field":"cvss","old":"7.8","new":null},{"seq":195969,"id":"CVE-2026-28607","ts":1789383399386,"field":"severity","old":"high","new":"none"},{"seq":194899,"id":"CVE-2026-28607","ts":1789380300413,"field":"cvss","old":null,"new":"7.8"},{"seq":194898,"id":"CVE-2026-28607","ts":1789380300413,"field":"severity","old":"none","new":"high"},{"seq":193686,"id":"CVE-2026-28607","ts":1789378268922,"field":"cvss","old":"7.8","new":null},{"seq":193685,"id":"CVE-2026-28607","ts":1789378268922,"field":"severity","old":"high","new":"none"},{"seq":192473,"id":"CVE-2026-28607","ts":1789376233295,"field":"cvss","old":null,"new":"7.8"},{"seq":192472,"id":"CVE-2026-28607","ts":1789376233295,"field":"severity","old":"none","new":"high"},{"seq":191260,"id":"CVE-2026-28607","ts":1789373126613,"field":"cvss","old":"7.8","new":null},{"seq":191259,"id":"CVE-2026-28607","ts":1789373126613,"field":"severity","old":"high","new":"none"},{"seq":190045,"id":"CVE-2026-28607","ts":1789369121039,"field":"cvss","old":null,"new":"7.8"},{"seq":190044,"id":"CVE-2026-28607","ts":1789369121039,"field":"severity","old":"none","new":"high"},{"seq":188832,"id":"CVE-2026-28607","ts":1789368038357,"field":"cvss","old":"7.8","new":null},{"seq":188831,"id":"CVE-2026-28607","ts":1789368038357,"field":"severity","old":"high","new":"none"},{"seq":187615,"id":"CVE-2026-28607","ts":1789364996522,"field":"cvss","old":null,"new":"7.8"},{"seq":187614,"id":"CVE-2026-28607","ts":1789364996522,"field":"severity","old":"none","new":"high"},{"seq":186402,"id":"CVE-2026-28607","ts":1789363002386,"field":"cvss","old":"7.8","new":null},{"seq":186401,"id":"CVE-2026-28607","ts":1789363002386,"field":"severity","old":"high","new":"none"},{"seq":185188,"id":"CVE-2026-28607","ts":1789360969712,"field":"cvss","old":null,"new":"7.8"},{"seq":185187,"id":"CVE-2026-28607","ts":1789360969712,"field":"severity","old":"none","new":"high"},{"seq":183975,"id":"CVE-2026-28607","ts":1789357943410,"field":"cvss","old":"7.8","new":null},{"seq":183974,"id":"CVE-2026-28607","ts":1789357943410,"field":"severity","old":"high","new":"none"},{"seq":182227,"id":"CVE-2026-28607","ts":1789354097901,"field":"cvss","old":null,"new":"7.8"},{"seq":182226,"id":"CVE-2026-28607","ts":1789354097901,"field":"severity","old":"none","new":"high"},{"seq":181020,"id":"CVE-2026-28607","ts":1789352943377,"field":"cvss","old":"7.8","new":null},{"seq":181019,"id":"CVE-2026-28607","ts":1789352943377,"field":"severity","old":"high","new":"none"},{"seq":179813,"id":"CVE-2026-28607","ts":1789350001085,"field":"cvss","old":null,"new":"7.8"},{"seq":179812,"id":"CVE-2026-28607","ts":1789350001085,"field":"severity","old":"none","new":"high"},{"seq":178606,"id":"CVE-2026-28607","ts":1789347814322,"field":"cvss","old":"7.8","new":null},{"seq":178605,"id":"CVE-2026-28607","ts":1789347814322,"field":"severity","old":"high","new":"none"},{"seq":177399,"id":"CVE-2026-28607","ts":1789346181715,"field":"cvss","old":null,"new":"7.8"},{"seq":177398,"id":"CVE-2026-28607","ts":1789346181715,"field":"severity","old":"none","new":"high"},{"seq":176192,"id":"CVE-2026-28607","ts":1789342752011,"field":"cvss","old":"7.8","new":null},{"seq":176191,"id":"CVE-2026-28607","ts":1789342752011,"field":"severity","old":"high","new":"none"},{"seq":175976,"id":"CVE-2026-28607","ts":1789342358514,"field":"cvss","old":null,"new":"7.8"},{"seq":175975,"id":"CVE-2026-28607","ts":1789342358514,"field":"severity","old":"none","new":"high"},{"seq":175516,"id":"CVE-2026-28607","ts":1789338390013,"field":"cvss","old":"7.8","new":null},{"seq":175515,"id":"CVE-2026-28607","ts":1789338390013,"field":"severity","old":"high","new":"none"},{"seq":174311,"id":"CVE-2026-28607","ts":1789334604766,"field":"cvss","old":null,"new":"7.8"},{"seq":174310,"id":"CVE-2026-28607","ts":1789334604766,"field":"severity","old":"none","new":"high"},{"seq":173106,"id":"CVE-2026-28607","ts":1789333197427,"field":"cvss","old":"7.8","new":null},{"seq":173105,"id":"CVE-2026-28607","ts":1789333197427,"field":"severity","old":"high","new":"none"},{"seq":171920,"id":"CVE-2026-28607","ts":1789330884480,"field":"cvss","old":null,"new":"7.8"},{"seq":171919,"id":"CVE-2026-28607","ts":1789330884480,"field":"severity","old":"none","new":"high"}]}