---
id: "CVE-2026-28665"
kind: "vulnerability"
aliases: ["CVE-2026-28665"]
title: "Android: cross-profile consent dialog label injection allows local privilege escalation"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "mobile", "other"]
not_affected_if: ["unknown"]
published_at: "2026-11-02T20:17:42+00:00"
first_seen_at: "2026-11-02T20:35:26+00:00"
updated_at: "2026-11-02T20:40:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28665", "first_seen_at": "2026-11-02T20:35:26+00:00"}]
---

# Android: cross-profile consent dialog label injection allows local privilege escalation

A flaw in the Android settings app's startup code lets a crafted label be injected into a cross-profile consent dialog. A local app can use this to escalate privileges on the device without user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T20:35:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28665

## From the sources

In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_