{"id":"CVE-2026-28655","title":"In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code","summary":"In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-693"],"vendor":"google","product":"android","affected":["android = 14.0","android = 15.0","android = 16.0","android = 17.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:14:31.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28655","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"epss":0.00077,"epssPercentile":0.00144,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:57:22.535094Z"},"ingestedAt":"2026-09-08T19:08:49.642Z","slug":"CVE-2026-28655","body":"## Overview\n\nIn multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 14.0`\n- `android = 15.0`\n- `android = 16.0`\n- `android = 17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201573,"id":"CVE-2026-28655","ts":1789399511060,"field":"cvss","old":null,"new":"7.8"},{"seq":201572,"id":"CVE-2026-28655","ts":1789399511060,"field":"severity","old":"none","new":"high"},{"seq":200307,"id":"CVE-2026-28655","ts":1789397086489,"field":"cvss","old":"7.8","new":null},{"seq":200306,"id":"CVE-2026-28655","ts":1789397086489,"field":"severity","old":"high","new":"none"},{"seq":198231,"id":"CVE-2026-28655","ts":1789391744464,"field":"cvss","old":null,"new":"7.8"},{"seq":198230,"id":"CVE-2026-28655","ts":1789391744464,"field":"severity","old":"none","new":"high"},{"seq":196024,"id":"CVE-2026-28655","ts":1789383399576,"field":"cvss","old":"7.8","new":null},{"seq":196023,"id":"CVE-2026-28655","ts":1789383399576,"field":"severity","old":"high","new":"none"},{"seq":194953,"id":"CVE-2026-28655","ts":1789380300586,"field":"cvss","old":null,"new":"7.8"},{"seq":194952,"id":"CVE-2026-28655","ts":1789380300586,"field":"severity","old":"none","new":"high"},{"seq":193740,"id":"CVE-2026-28655","ts":1789378269112,"field":"cvss","old":"7.8","new":null},{"seq":193739,"id":"CVE-2026-28655","ts":1789378269112,"field":"severity","old":"high","new":"none"},{"seq":192527,"id":"CVE-2026-28655","ts":1789376233491,"field":"cvss","old":null,"new":"7.8"},{"seq":192526,"id":"CVE-2026-28655","ts":1789376233491,"field":"severity","old":"none","new":"high"},{"seq":191314,"id":"CVE-2026-28655","ts":1789373126796,"field":"cvss","old":"7.8","new":null},{"seq":191313,"id":"CVE-2026-28655","ts":1789373126796,"field":"severity","old":"high","new":"none"},{"seq":190099,"id":"CVE-2026-28655","ts":1789369121237,"field":"cvss","old":null,"new":"7.8"},{"seq":190098,"id":"CVE-2026-28655","ts":1789369121237,"field":"severity","old":"none","new":"high"},{"seq":188886,"id":"CVE-2026-28655","ts":1789368038539,"field":"cvss","old":"7.8","new":null},{"seq":188885,"id":"CVE-2026-28655","ts":1789368038539,"field":"severity","old":"high","new":"none"},{"seq":187669,"id":"CVE-2026-28655","ts":1789364996683,"field":"cvss","old":null,"new":"7.8"},{"seq":187668,"id":"CVE-2026-28655","ts":1789364996683,"field":"severity","old":"none","new":"high"},{"seq":186456,"id":"CVE-2026-28655","ts":1789363002600,"field":"cvss","old":"7.8","new":null},{"seq":186455,"id":"CVE-2026-28655","ts":1789363002600,"field":"severity","old":"high","new":"none"},{"seq":185242,"id":"CVE-2026-28655","ts":1789360969876,"field":"cvss","old":null,"new":"7.8"},{"seq":185241,"id":"CVE-2026-28655","ts":1789360969876,"field":"severity","old":"none","new":"high"},{"seq":184029,"id":"CVE-2026-28655","ts":1789357943593,"field":"cvss","old":"7.8","new":null},{"seq":184028,"id":"CVE-2026-28655","ts":1789357943593,"field":"severity","old":"high","new":"none"},{"seq":182281,"id":"CVE-2026-28655","ts":1789354098070,"field":"cvss","old":null,"new":"7.8"},{"seq":182280,"id":"CVE-2026-28655","ts":1789354098070,"field":"severity","old":"none","new":"high"},{"seq":181074,"id":"CVE-2026-28655","ts":1789352943590,"field":"cvss","old":"7.8","new":null},{"seq":181073,"id":"CVE-2026-28655","ts":1789352943590,"field":"severity","old":"high","new":"none"},{"seq":179867,"id":"CVE-2026-28655","ts":1789350001276,"field":"cvss","old":null,"new":"7.8"},{"seq":179866,"id":"CVE-2026-28655","ts":1789350001276,"field":"severity","old":"none","new":"high"},{"seq":178660,"id":"CVE-2026-28655","ts":1789347814512,"field":"cvss","old":"7.8","new":null},{"seq":178659,"id":"CVE-2026-28655","ts":1789347814512,"field":"severity","old":"high","new":"none"},{"seq":177453,"id":"CVE-2026-28655","ts":1789346181874,"field":"cvss","old":null,"new":"7.8"},{"seq":177452,"id":"CVE-2026-28655","ts":1789346181874,"field":"severity","old":"none","new":"high"},{"seq":176246,"id":"CVE-2026-28655","ts":1789342752189,"field":"cvss","old":"7.8","new":null},{"seq":176245,"id":"CVE-2026-28655","ts":1789342752189,"field":"severity","old":"high","new":"none"},{"seq":176030,"id":"CVE-2026-28655","ts":1789342358694,"field":"cvss","old":null,"new":"7.8"},{"seq":176029,"id":"CVE-2026-28655","ts":1789342358694,"field":"severity","old":"none","new":"high"},{"seq":175570,"id":"CVE-2026-28655","ts":1789338390193,"field":"cvss","old":"7.8","new":null},{"seq":175569,"id":"CVE-2026-28655","ts":1789338390193,"field":"severity","old":"high","new":"none"},{"seq":174365,"id":"CVE-2026-28655","ts":1789334604930,"field":"cvss","old":null,"new":"7.8"},{"seq":174364,"id":"CVE-2026-28655","ts":1789334604930,"field":"severity","old":"none","new":"high"},{"seq":173160,"id":"CVE-2026-28655","ts":1789333197615,"field":"cvss","old":"7.8","new":null},{"seq":173159,"id":"CVE-2026-28655","ts":1789333197615,"field":"severity","old":"high","new":"none"},{"seq":171974,"id":"CVE-2026-28655","ts":1789330884646,"field":"cvss","old":null,"new":"7.8"},{"seq":171973,"id":"CVE-2026-28655","ts":1789330884646,"field":"severity","old":"none","new":"high"}]}