{"id":"CVE-2026-28644","title":"In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy","summary":"In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User intera…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-441"],"vendor":"google","product":"android","affected":["android = 14.0","android = 15.0","android = 16.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:13:17.673","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28644","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"epss":0.00068,"epssPercentile":0.00033,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:57:21.196859Z"},"ingestedAt":"2026-09-08T19:08:49.642Z","slug":"CVE-2026-28644","body":"## Overview\n\nIn startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 14.0`\n- `android = 15.0`\n- `android = 16.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201565,"id":"CVE-2026-28644","ts":1789399511035,"field":"cvss","old":null,"new":"7.8"},{"seq":201564,"id":"CVE-2026-28644","ts":1789399511035,"field":"severity","old":"none","new":"high"},{"seq":200299,"id":"CVE-2026-28644","ts":1789397086461,"field":"cvss","old":"7.8","new":null},{"seq":200298,"id":"CVE-2026-28644","ts":1789397086461,"field":"severity","old":"high","new":"none"},{"seq":198223,"id":"CVE-2026-28644","ts":1789391743880,"field":"cvss","old":null,"new":"7.8"},{"seq":198222,"id":"CVE-2026-28644","ts":1789391743880,"field":"severity","old":"none","new":"high"},{"seq":196016,"id":"CVE-2026-28644","ts":1789383399548,"field":"cvss","old":"7.8","new":null},{"seq":196015,"id":"CVE-2026-28644","ts":1789383399548,"field":"severity","old":"high","new":"none"},{"seq":194945,"id":"CVE-2026-28644","ts":1789380300561,"field":"cvss","old":null,"new":"7.8"},{"seq":194944,"id":"CVE-2026-28644","ts":1789380300561,"field":"severity","old":"none","new":"high"},{"seq":193732,"id":"CVE-2026-28644","ts":1789378269086,"field":"cvss","old":"7.8","new":null},{"seq":193731,"id":"CVE-2026-28644","ts":1789378269086,"field":"severity","old":"high","new":"none"},{"seq":192519,"id":"CVE-2026-28644","ts":1789376233463,"field":"cvss","old":null,"new":"7.8"},{"seq":192518,"id":"CVE-2026-28644","ts":1789376233463,"field":"severity","old":"none","new":"high"},{"seq":191306,"id":"CVE-2026-28644","ts":1789373126769,"field":"cvss","old":"7.8","new":null},{"seq":191305,"id":"CVE-2026-28644","ts":1789373126769,"field":"severity","old":"high","new":"none"},{"seq":190091,"id":"CVE-2026-28644","ts":1789369121206,"field":"cvss","old":null,"new":"7.8"},{"seq":190090,"id":"CVE-2026-28644","ts":1789369121206,"field":"severity","old":"none","new":"high"},{"seq":188878,"id":"CVE-2026-28644","ts":1789368038511,"field":"cvss","old":"7.8","new":null},{"seq":188877,"id":"CVE-2026-28644","ts":1789368038511,"field":"severity","old":"high","new":"none"},{"seq":187661,"id":"CVE-2026-28644","ts":1789364996659,"field":"cvss","old":null,"new":"7.8"},{"seq":187660,"id":"CVE-2026-28644","ts":1789364996659,"field":"severity","old":"none","new":"high"},{"seq":186448,"id":"CVE-2026-28644","ts":1789363002568,"field":"cvss","old":"7.8","new":null},{"seq":186447,"id":"CVE-2026-28644","ts":1789363002568,"field":"severity","old":"high","new":"none"},{"seq":185234,"id":"CVE-2026-28644","ts":1789360969852,"field":"cvss","old":null,"new":"7.8"},{"seq":185233,"id":"CVE-2026-28644","ts":1789360969852,"field":"severity","old":"none","new":"high"},{"seq":184021,"id":"CVE-2026-28644","ts":1789357943566,"field":"cvss","old":"7.8","new":null},{"seq":184020,"id":"CVE-2026-28644","ts":1789357943566,"field":"severity","old":"high","new":"none"},{"seq":182273,"id":"CVE-2026-28644","ts":1789354098045,"field":"cvss","old":null,"new":"7.8"},{"seq":182272,"id":"CVE-2026-28644","ts":1789354098045,"field":"severity","old":"none","new":"high"},{"seq":181066,"id":"CVE-2026-28644","ts":1789352943559,"field":"cvss","old":"7.8","new":null},{"seq":181065,"id":"CVE-2026-28644","ts":1789352943559,"field":"severity","old":"high","new":"none"},{"seq":179859,"id":"CVE-2026-28644","ts":1789350001246,"field":"cvss","old":null,"new":"7.8"},{"seq":179858,"id":"CVE-2026-28644","ts":1789350001246,"field":"severity","old":"none","new":"high"},{"seq":178652,"id":"CVE-2026-28644","ts":1789347814483,"field":"cvss","old":"7.8","new":null},{"seq":178651,"id":"CVE-2026-28644","ts":1789347814483,"field":"severity","old":"high","new":"none"},{"seq":177445,"id":"CVE-2026-28644","ts":1789346181850,"field":"cvss","old":null,"new":"7.8"},{"seq":177444,"id":"CVE-2026-28644","ts":1789346181850,"field":"severity","old":"none","new":"high"},{"seq":176238,"id":"CVE-2026-28644","ts":1789342752163,"field":"cvss","old":"7.8","new":null},{"seq":176237,"id":"CVE-2026-28644","ts":1789342752163,"field":"severity","old":"high","new":"none"},{"seq":176022,"id":"CVE-2026-28644","ts":1789342358667,"field":"cvss","old":null,"new":"7.8"},{"seq":176021,"id":"CVE-2026-28644","ts":1789342358667,"field":"severity","old":"none","new":"high"},{"seq":175562,"id":"CVE-2026-28644","ts":1789338390166,"field":"cvss","old":"7.8","new":null},{"seq":175561,"id":"CVE-2026-28644","ts":1789338390166,"field":"severity","old":"high","new":"none"},{"seq":174357,"id":"CVE-2026-28644","ts":1789334604905,"field":"cvss","old":null,"new":"7.8"},{"seq":174356,"id":"CVE-2026-28644","ts":1789334604905,"field":"severity","old":"none","new":"high"},{"seq":173152,"id":"CVE-2026-28644","ts":1789333197588,"field":"cvss","old":"7.8","new":null},{"seq":173151,"id":"CVE-2026-28644","ts":1789333197588,"field":"severity","old":"high","new":"none"},{"seq":171966,"id":"CVE-2026-28644","ts":1789330884623,"field":"cvss","old":null,"new":"7.8"},{"seq":171965,"id":"CVE-2026-28644","ts":1789330884623,"field":"severity","old":"none","new":"high"}]}