A high-severity local privilege escalation vulnerability in Google Android allows attackers to bypass security restrictions governing application installation without requiring user interaction.

This flaw exists within the setupLayout function of PickActivity.java, where a confused deputy issue permits an attacker with local, low-privileged access to circumvent the Install unknown apps security policy. Exploitation does not require user interaction, enabling unauthorized elevation of privilege on the local system.

Successful exploitation of this vulnerability results in full local privilege escalation, allowing an attacker to bypass critical security controls designed to prevent the installation of unauthorized or malicious software. Given the CVSS score of 7.8, this represents a significant threat to device integrity, potentially facilitating persistent malware installation, unauthorized data access, and complete compromise of the affected device environment.

Immediate Action: Organizations and users should apply the latest security updates provided by Google as soon as they are made available for their specific device models.

Proactive Monitoring: Security teams should monitor device logs for unexpected application installation events or modifications to system security configurations that deviate from established baselines.

Compensating Controls: Ensure that mobile device management (MDM) policies restrict the ability for users to enable unknown sources, which can limit the impact of such bypasses even if the underlying vulnerability remains unpatched.

Public Exploit Available: No

CVE-2026-28636 presents a substantial security risk due to its potential to undermine fundamental Android security protections. Administrators should prioritize the deployment of vendor security patches across their mobile fleets immediately upon release to prevent local privilege escalation and subsequent unauthorized software installation.