{"id":"CVE-2026-28665","kind":"vulnerability","aliases":["CVE-2026-28665"],"related":[],"title":"Android: cross-profile consent dialog label injection allows local privilege escalation","description":"In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A flaw in the Android settings app's startup code lets a crafted label be injected into a cross-profile consent dialog. A local app can use this to escalate privileges on the device without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","other"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:42+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","triaged_at":"2026-11-02T20:40:49+00:00","updated_at":"2026-11-02T20:40:49+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-02T20:40:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: cross-profile consent dialog label injection allows local privilege escalation","impact":"high","summary":"A flaw in the Android settings app's startup code lets a crafted label be injected into a cross-profile consent dialog. A local app can use this to escalate privileges on the device without user interaction.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","mobile"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local app gains elevated privileges on the device","analyst_note":"Confirm affected Android versions and the patch level that fixes CVE-2026-28665 from the Android security bulletin, and whether the flaw needs a work profile to trigger.","how_to_check":"- unknown","plain_action":"Update your Android phone to the latest security patch level from your manufacturer or carrier.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The sources describe a local escalation of privilege in the Android settings app's SettingsApplication onCreate path, triggered through a cross-profile consent dialog label. Teams running Android fleets or managed devices should check their patch level; the sources do not name affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000643,"input_tokens":4098,"output_tokens":467,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-28665':15A,18A 'addit':89C 'allow':9A 'android':1A,19B,25B 'app':27B,46B 'code':30B 'consent':5A,42B,70C 'could':80C 'craft':33B 'cross':3A,40B,68C 'cross-profil':2A,39B,67C 'cve':13A,16A 'devic':55B 'dialog':6A,43B,71C 'due':74C 'escal':12A,51B,84C 'execut':90C 'exploit':99C 'flaw':22B 'improp':76C 'inject':8A,36B,73C 'input':77C 'interact':58B,94C 'label':7A,34B,72C 'lead':81C 'let':31B 'local':10A,45B,83C 'mobil':20B 'need':92C,97C 'oncreat':60C 'possibl':66C 'privileg':11A,52B,86C,91C 'profil':4A,41B,69C 'set':26B 'settingsapplication.java':62C 'startup':29B 'use':48B 'user':57B,93C 'valid':78C 'without':56B","nicknames":[],"mitigations":[],"who_affected":"The sources describe a local escalation of privilege in the Android settings app's SettingsApplication onCreate path, triggered through a cross-profile consent dialog label. Teams running Android fleets or managed devices should check their patch level; the sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","mobile","other","unknown"],"first_public_at":"2026-11-02T20:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28665","severity":null,"published_at":"2026-11-02T20:17:42+00:00","modified_at":"2026-11-02T20:17:42+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","fetched_at":"2026-11-02T20:35:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}