Security Digest: September 11, 2026 - 29 Critical Vulnerabilities

Today’s digest is dominated by 29 high-severity Android vulnerabilities, including multiple remote code execution flaws and a broad set of local privilege-escalation bugs affecting core system components. Several issues require no user interaction to exploit, which raises the risk for rapid weaponization once patches are public.

2026-09-11 · 18 min read

Android Zero-Days and RCE Bugs Demand Immediate Patch Action

Executive Summary

Today’s digest is dominated by 29 high-severity Android vulnerabilities, including multiple remote code execution flaws and a broad set of local privilege-escalation bugs affecting core system components. Several issues require no user interaction to exploit, which raises the risk for rapid weaponization once patches are public.

Action required now: prioritize emergency patching for exposed devices, fast-track OEM/security bulletin updates, and restrict risky app installation and background-activity paths until remediation is complete.

Critical Vulnerabilities

CVE-2026-28618: OAPV heap overflow leading to RCE
- Impact: Attackers can trigger remote code execution without extra privileges or user interaction.
- Affected Systems: Devices using the affected oapv.c decoder path.
- Immediate Action: Patch immediately and remove untrusted media processing from high-risk endpoints.
- Mitigation: Apply the vendor update that fixes the heap buffer overflow; block suspicious media content until patched.
CVE-2026-28609: MatroskaExtractor out-of-bounds write
- Impact: Remote code execution via malformed media files.
- Affected Systems: Devices using the affected MatroskaExtractor.cpp component.
- Immediate Action: Deploy the patch and quarantine untrusted video files.
- Mitigation: Update the media stack; disable preview/auto-processing of unknown files where possible.
CVE-2026-28666: DNG rendering bypass causing persistent denial of service
- Impact: Persistent device instability and potential remote escalation of privilege.
- Affected Systems: Devices using LocalImageResolver.java.
- Immediate Action: Patch urgently on devices that process images from external sources.
- Mitigation: Apply the update and limit DNG handling from untrusted apps or services.
CVE-2026-28636: Unknown-app install restriction bypass
- Impact: Attackers may bypass the “Install unknown apps” control and elevate privileges locally.
- Affected Systems: Android devices with the affected PickActivity.java flow.
- Immediate Action: Patch and review sideloading policy immediately.
- Mitigation: Update system components; temporarily disable sideloading on managed devices.
CVE-2026-28642: Background activity launch via logic error
- Impact: Local privilege escalation through unauthorized background launches.
- Affected Systems: Devices using affected ActivityStarter.java code.
- Immediate Action: Apply the security update and audit app behavior that depends on background launches.
- Mitigation: Patch the framework component; restrict suspicious app automation until fixed.
CVE-2026-28658: FRP bypass in AccountsDb
- Impact: Attackers may bypass factory reset protection and gain local escalation.
- Affected Systems: Devices using affected AccountsDb.java logic.
- Immediate Action: Prioritize patching on consumer and fleet devices with account recovery exposure.
- Mitigation: Install the vendor fix and verify FRP enforcement after update.
CVE-2026-28657: Unauthorized URI permission grant
- Impact: Unauthorized access to content via confused-deputy behavior.
- Affected Systems: Devices using AppWidgetConfigActivityProxy.java.
- Immediate Action: Patch and review app/widget permission flows.
- Mitigation: Update system services; revoke unnecessary URI grants where feasible.
CVE-2026-28650: Overlay bypass in WindowState
- Impact: Attackers can bypass overlay protections and mislead users.
- Affected Systems: Devices using affected WindowState.java.
- Immediate Action: Patch immediately, especially on devices used for sensitive approvals.
- Mitigation: Apply the framework update and harden overlay/tapjacking defenses.
CVE-2026-28634: USSD request without permission
- Impact: Unauthorized USSD actions could be triggered locally.
- Affected Systems: Devices using PhoneInterfaceManager.java.
- Immediate Action: Patch and monitor telecom-related abuse indicators.
- Mitigation: Update telephony components; restrict app access to call-related APIs.
CVE-2026-28663: Background activity launch via BAL bypass
- Impact: Local privilege escalation through unauthorized activity launches.
- Affected Systems: Devices using LauncherAppsService.java.
- Immediate Action: Patch and review launcher-related enterprise policies.
- Mitigation: Apply the security update; monitor for unusual app-to-app launch chains.
CVE-2026-28644: Permission bypass in ActivityTaskManagerService
- Impact: Attackers may bypass permissions via a confused deputy.
- Affected Systems: Devices using affected ActivityTaskManagerService.java logic.
- Immediate Action: Deploy patch across all supported Android builds.
- Mitigation: Update the framework and validate permission boundaries after remediation.
CVE-2026-28616: Setup Wizard malicious network connection
- Impact: Devices may be forced onto attacker-controlled networks.
- Affected Systems: Devices using the affected Setup Wizard flow.
- Immediate Action: Patch before provisioning new devices or re-enrolling fleets.
- Mitigation: Apply the fix and restrict onboarding to trusted networks only.
CVE-2026-28631: Consent bypass via tapjacking in IntentForwarderActivity
- Impact: Users can be tricked into granting actions they did not intend.
- Affected Systems: Devices using IntentForwarderActivity.java.
- Immediate Action: Patch and warn users about overlay-based attacks.
- Mitigation: Update system components and block suspicious overlay-capable apps.
CVE-2026-28655: Background activity launch bypass in RemoteViews
- Impact: Unauthorized app launches from the background.
- Affected Systems: Devices using RemoteViews.java.
- Immediate Action: Patch promptly and inspect notification/widget abuse.
- Mitigation: Apply the framework update; monitor for unexpected widget-driven launches.
CVE-2026-45520: Authentication bypass in BiometricsSettingsBase
- Impact: Attackers may bypass biometric-related authentication controls.
- Affected Systems: Devices using BiometricsSettingsBase.java.
- Immediate Action: Patch immediately on any device using biometric enrollment/settings flows.
- Mitigation: Install the vendor fix and verify biometric policy enforcement.
CVE-2026-28614: Permission bypass in SlicePermissionActivity
- Impact: Local privilege escalation through confused-deputy behavior.
- Affected Systems: Devices using SlicePermissionActivity.java.
- Immediate Action: Patch and review slice/content permission exposure.
- Mitigation: Apply the update and reduce unnecessary permission surfaces.
CVE-2026-28603: Private file access via AppRestrictionsFragment
- Impact: Unauthorized read/write access to private files.
- Affected Systems: Devices using AppRestrictionsFragment.java.
- Immediate Action: Patch urgently and review app restriction workflows.
- Mitigation: Update the system component and audit file-access permissions.
CVE-2026-28612: Intent redirection in ActivityStarter
- Impact: Attackers can redirect intents and escalate privileges locally.
- Affected Systems: Devices using ActivityStarter.java.
- Immediate Action: Patch now and inspect apps that forward intents.
- Mitigation: Apply the framework fix and tighten intent validation.
CVE-2026-0065: Background activity launch allowed unexpectedly
- Impact: Apps with user execution privileges may launch activities in the background.
- Affected Systems: Devices using BackgroundLaunchProcessController.java.
- Immediate Action: Patch and review apps that rely on background task flows.
- Mitigation: Update system services; restrict high-risk automation until fixed.
CVE-2026-28599: Intent redirection bypass in ActivityManagerService
- Impact: Attackers may bypass intent redirection protections.
- Affected Systems: Devices using ActivityManagerService.java.
- Immediate Action: Deploy patch across all managed Android devices.
- Mitigation: Apply vendor updates and monitor for unusual activity handoffs.
CVE-2026-28600: Default payment app change via confused deputy
- Impact: Attackers may alter the default payment app locally.
- Affected Systems: Devices using PaymentDefaultDialog.java.
- Immediate Action: Patch and verify payment defaults on employee devices.
- Mitigation: Update system components and re-check wallet/payment settings after patching.
CVE-2026-0084: Background activity launch in HostEmulationManager
- Impact: Unauthorized background launches can enable privilege escalation.
- Affected Systems: Devices using HostEmulationManager.java.
- Immediate Action: Patch and review NFC/emulation-related app behavior.
- Mitigation: Apply the fix and limit risky host emulation use cases.
CVE-2026-28602: Multi-user isolation bypass in ClipboardService
- Impact: Clipboard data may leak across users or profiles.
- Affected Systems: Devices using ClipboardService.java.
- Immediate Action: Patch immediately on shared and enterprise-managed devices.
- Mitigation: Install the update and verify work/personal profile separation.
CVE-2026-28611: Silent payment session hijacking in NfcService
- Impact: Attackers may hijack payment sessions without user awareness.
- Affected Systems: Devices using NfcService.java.
- Immediate Action: Patch urgently on devices used for tap-to-pay.
- Mitigation: Update NFC components and monitor payment app anomalies.
CVE-2026-28593: User interaction bypass in SettingsFragment
- Impact: Misleading UI can trick users into unintended actions.
- Affected Systems: Devices using SettingsFragment.java.
- Immediate Action: Patch and alert users to deceptive settings prompts.
- Mitigation: Apply the fix and reduce exposure to untrusted settings overlays.
CVE-2026-28604: Use-after-free race condition leading to RCE
- Impact: Remote code execution without additional privileges or user interaction.
- Affected Systems: Devices using the affected multi-location code paths.
- Immediate Action: Treat as emergency patch material.
- Mitigation: Apply the vendor update immediately and minimize exposure to untrusted inputs.
CVE-2026-28613: Arbitrary intent launch in ChannelImpl
- Impact: Attackers can launch arbitrary intents locally.
- Affected Systems: Devices using ChannelImpl.java.
- Immediate Action: Patch and review apps that accept external intent data.
- Mitigation: Update the component and enforce stricter input validation.
CVE-2026-28656: Overlay attack in DeviceAdminAdd
- Impact: Tapjacking can trick users during device admin enrollment.
- Affected Systems: Devices using DeviceAdminAdd.java.
- Immediate Action: Patch before any device-admin enrollment or re-enrollment.
- Mitigation: Apply the fix and block overlay-capable apps during admin setup.
CVE-2026-28626: Intent redirection in SetupPassthroughActivity
- Impact: Attackers may launch arbitrary activities and escalate privileges.
- Affected Systems: Devices using SetupPassthroughActivity.java.
- Immediate Action: Patch immediately on devices in onboarding or setup workflows.
- Mitigation: Update the system component and validate setup flows after patching.

Previously Alerted

CVE-2026-69676 — Security Digest: September 9, 2026 - 108 Critical Vulnerabilities
CVE-2026-84003 — Security Digest: September 9, 2026 - 108 Critical Vulnerabilities
CVE-2026-66820 — Security Digest: September 9, 2026 - 108 Critical Vulnerabilities
CVE-2026-68839 — CVE-2026-68839 Security Alert: CRITICAL Vulnerability
CVE-2026-28606 — CVE-2026-28606 Security Alert: CRITICAL Vulnerability

What to Do Now

Patch first: deploy the latest Android security update and OEM-specific firmware fixes across all supported devices.
Prioritize exposure: start with internet-facing, employee-owned, kiosk, payment, and shared-profile devices.
Reduce attack surface: temporarily disable sideloading, review overlay-capable apps, and limit untrusted media handling.
Verify: confirm patch level, reboot if required, and check that FRP, NFC, clipboard, and permission controls still enforce correctly.
Monitor: look for unusual intent launches, background activity starts, payment-session anomalies, and repeated crashes tied to media parsing.

Verification steps:

Check device security patch level against the latest vendor bulletin.
Confirm managed devices received the update and completed a reboot.
Review logs for suspicious app launches, widget interactions, and NFC/payment events.

Monitoring recommendations: increase alerting on privilege-escalation indicators, overlay activity, telephony/USSD usage, and media-file processing from unknown sources.

Related Resources

Internal analysis: Android September 2026 Patch Triage (to be published)
Internal guidance: Mobile Fleet Emergency Patching Playbook (to be published)
Official vendor advisories: Android Security Bulletin and OEM monthly security releases