CVE-2026-28636

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

The vulnerability is due to a logic error in the code that allows bypassing security controls. It could lead to local escalation of privilege with no additional execution privileges needed, but user interaction is required for exploitation.

In onCreate of WindowState.java, there is a logic error that allows launching a background activity. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.