Android: Permission bypass in device admin apps settings enables local privilege escalation
Summary
A logic error in the device admin apps settings component (DeviceAdminAppsPreferenceController, updateState) of Android allows a permission bypass. A local attacker with low privileges, for example a malicious app already running on the device, can escalate privileges to a higher level. No user interaction is required, and no additional execution privileges are needed.
Affected
- Android 14, 15 and 16-qpr2 (AOSP branches per the October 2026 bulletin)
- Android Automotive OS: the affected AOSP branches are listed in the AAOS bulletin
- Specific device models that are affected: Unknown.
Fixed in
- Security patch level 2026-10-01 or later (Android Security Bulletin October 2026)
- For Android Automotive OS: full AAOS update with security patch level 2026-10-05 or later
- Check the patch level under Settings, not only the date of the Google Play system update.
Workaround
- None found. No vendor-published mitigation is known. Installing the security update is the remedy.
Exploitation
- No evidence of active exploitation found. Google does not indicate active exploitation in the bulletin.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- Not marked as known exploited in the sources reviewed (CISA KEV catalogue not directly checked).
- No public proof of concept found.
Our recommendation
- Install the October 2026 security update (patch level 2026-10-01 or later) on managed phones and tablets, and the AAOS update 2026-10-05 or later on vehicle systems.
- Verify the patch level on each device and confirm that the phone bulletin covers this CVE before reporting the fleet as protected.
- Restrict installation of apps to trusted sources and monitor for unusual privilege changes on devices.
- Priority: moderate. Not an emergency unless a compromise is already suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin - October 2026 (AAOS) source.android.com
- Android Security Bulletin - October 2026 source.android.com
- Vulnrichment record CVE-2026-28647 (CVSS 3.1) vulners.com
- CISA ADP Vulnrichment record CVE-2026-28647 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:31.
Original description (NVD)
In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.