Google Android: Permission bypass (confused deputy) in Settings
Summary
A confused deputy flaw in the Android Settings component allows a permission bypass. A local attacker or malicious app can use it to escalate privileges on the device without additional execution privileges and without user interaction. The CVSS vector rates confidentiality, integrity and availability impact as High.
Affected
- Android 14, 15, 16 and 16-qpr2 (as listed in the October 2026 Android Security Bulletin, AAOS page)
- Android 13 and older are not listed; vendor support status must be checked
- Devices with manufacturer-specific bulletins may be affected differently
Fixed in
- Security patch level 2026-10-01 or later per the main bulletin (unconfirmed, see note)
- AAOS page refers to patch level 2026-10-05 or later
- Exact fixed build numbers: Unknown.
- Pixel and other OEM fixes are published in separate bulletins.
Workaround
Unknown. No workaround or mitigation is described by the vendor.
Exploitation
- Not marked as known exploited in the sources reviewed; CISA KEV status not directly verified.
- No public exploit or proof of concept found.
- Reported by Shengxin Xia (credited by Google).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check the security patch level on all Android devices (Settings > About phone > Android version).
- Enforce the October 2026 security update via MDM and report non-compliant devices.
- Check each device manufacturer's October 2026 bulletin, not only Google's.
- Retire devices running Android 13 or older, or confirm vendor support.
- Restrict installation of apps from unknown sources and review installed apps with access to business data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin—October 2026 (AAOS) source.android.com
- VulnCheck/Vulners enrichment CVE-2026-28648 vulners.com
- Android Acknowledgements source.android.com
- ThreatInt CVE-2026-28648 cve.threatint.com
- Strix CVE-2026-28648 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:31.
Original description (NVD)
In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.