Arbitrary Intent Launch in Android ChannelImpl

Publication date: 2026-09-08

Last updated on: 2026-09-15

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description

In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-15

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-28613

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	14.0
google	android	15.0
google	android	16.0
google	android	16.0
google	android	17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper input validation in the Android system's ChannelImpl.java file. Specifically, it occurs in the initAppLinkTypeAndIntent function where an arbitrary intent can be launched due to this flaw. Exploitation requires user interaction but no additional execution privileges, potentially leading to local privilege escalation.

Impact Analysis

This vulnerability could allow an attacker to escalate their privileges on your device locally. Since user interaction is required, it might involve tricking you into performing an action that triggers the exploit. The impact includes potential unauthorized access to sensitive functions or data on your device.

Mitigation Strategies

Apply the latest Android security patches immediately to address the improper input validation in ChannelImpl.java. Monitor official Android security bulletins for updates and ensure all devices are updated.

Hi! I’m here to help you understand CVE-2026-28613. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70