CVE-2026-28626

unknowncovered by 2 sourcesfirst seen 2026-09-08

In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

⚡ Watch CVE-2026-28626

Get an email if CVE-2026-28626 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (2)

unknownAndroid Multiple Vulnerabilitieshkcert · 2026-09-09
unknownCVE-2026-28626: In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary acti…nvd · 2026-09-08

External references

NVD record for CVE-2026-28626

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-28626 status](https://www.csirts.com/badge/CVE-2026-28626)](https://www.csirts.com/cve/CVE-2026-28626)