CVE-2026-28641

Executive Summary

CVE-2026-28641 is a local privilege escalation vulnerability in the Android operating system's application management subsystem. The flaw is a permission bypass logic error in the shouldDisableUninstallButton method within ApplicationActionButtonsPreferenceController.java, a component of the Android Settings application responsible for rendering application management controls. An attacker with local access to a device can exploit this logic error to bypass intended permission checks, potentially escalating privileges without requiring any user interaction. No official CVSS score, CWE classification, EPSS score, or patch information has been published for this CVE at the time of this report.

Technical Analysis

CVE-2026-28641 resides in ApplicationActionButtonsPreferenceController.java, a source file within the Android Settings application framework. The vulnerable method, shouldDisableUninstallButton, is responsible for determining whether the uninstall action button for an application should be rendered in a disabled (non-interactive) state within the Settings UI.

The vulnerability class is a logic error resulting in a permission bypass. In Android's security model, the ability to uninstall applications is governed by a combination of:

• Package installer permissions (android.permission.DELETE_PACKAGES)
• Device administrator status — applications registered as device administrators or device owners may be protected from uninstallation
• Profile owner / device owner constraints — managed device policies may prevent certain applications from being removed
• System application protections — critical system components are typically non-uninstallable

The method shouldDisableUninstallButton is the UI-layer gatekeeper that decides whether the uninstall button is presented as actionable. A logic error in this decision method means the UI may present an uninstall option for an application that should be protected, or the underlying permission check is not correctly enforced when the uninstall action is invoked.

The critical security implication is that the logic error may bypass the intended authorization check, allowing a local actor to trigger uninstallation of protected applications. Because the NVD description states "no additional execution privileges needed" and "user interaction is not needed," the flaw is triggerable programmatically by a local application or process with basic execution context.

This type of logic error is distinct from a memory corruption or injection flaw. It does not require malformed input; rather, the decision logic itself returns an incorrect result under certain conditions. The exact conditional branches where the logic fails are not specified in the available data — no source code, patch diff, or detailed CNA advisory is available. Notably absent from the description is any statement that the uninstall button uninstall action itself re-validates permissions at the PackageManager service layer. If the UI check is the only enforcement point, then bypassing it results in an actual unauthorized uninstall; if a service-layer check exists independently, impact may be limited.

Attack surface: Local, requiring code execution context on the device (an installed application, an ADB shell with sufficient privileges, or another local vector). The vulnerability is in the Android Settings application, which runs with the SYSTEM_UID and holds elevated permissions including the ability to invoke package deletion.

Exploitation preconditions:

• Local access to the device (physical or via ADB/installed malicious app).
• Ability to invoke or influence the Settings application's UI logic.
• No user interaction required per NVD.

Exploitation difficulty: The NVD description implies the flaw is reliably triggerable once local access is achieved, as no race condition or memory corruption is described. However, no public proof-of-concept, exploit code, or Nuclei template exists.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-28641. The following attack chain is inferred strictly from the vulnerability class (logic error / improper authorization in an Android Settings controller) and the NVD description.

1. Reconnaissance / Target Identification An attacker gains a local foothold on the target Android device — for example, by convincing a user to install a seemingly benign application, by exploiting a separate initial-access vulnerability, or through physical/ADB access. The attacker identifies the device as running an affected Android build (exact affected versions are unavailable). The attacker enumerates installed packages to identify protected applications — device administrators, profile/device-owner-controlled apps, or system applications — that the shouldDisableUninstallButton logic is intended to guard.

2. Triggering the Specific Flaw Class The flaw is a logic error in an authorization decision function. The attacker crafts a sequence of interactions — via the Settings application's exposed components or through a locally installed application that invokes the relevant UI path — that causes shouldDisableUninstallButton to return the wrong value (indicating the uninstall button should be ENABLED for a protected application). Because the NVD description states user interaction is not needed, the trigger is programmatic: the malicious local app schedules or injects the action without requiring the victim to tap anything.

3. Payload / Execution Method (vulnerability-class level) At the vulnerability-class level, the "payload" is the crafted state or sequence that defeats the authorization logic. The attacker does not inject shellcode; instead, they invoke the uninstall action against a protected package after the UI-level permission gate has been bypassed. If no service-layer re-validation occurs, the uninstall proceeds using the Settings application's elevated (SYSTEM_UID) privileges. If a service-layer check does exist, the impact is reduced to UI inconsistency (a disabled-protection state rather than actual deletion) — the available data does not confirm which case applies.

4. Post-Exploitation Impact Successful exploitation results in unauthorized removal of a protected application. This can:

• Disable security controls enforced by a device administrator (e.g., MDM/EDR agents, VPN clients, or device management apps).
• Remove managed-profile security tooling, defeating enterprise device policies.
• Weaken the device's defensive posture by stripping protective applications, enabling follow-on attacks.

The NVD description classifies the outcome as "local escalation of privilege." No lateral movement or remote impact is implied.

No public PoC is available; the above chain is inferred from the vulnerability class.

Impact Assessment

CVE-2026-28641 is a local privilege escalation (LPE) vulnerability. The official CVSS score is not available (N/A), and no CVSS vector has been published by the vendor or NVD. The estimated vector in the METADATA section (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is provided for analytical context only and must not be treated as authoritative.

Business impact considerations:

• Enterprise-managed Android fleets: Devices under MDM/EMM management rely on device administrator and device owner protections to prevent removal of management and security agents. A bypass that permits uninstallation of protected applications undermines the entire enterprise mobility management control plane.
• BYOD environments: Managed profiles on employee-owned devices may be compromised, allowing removal of work-profile security tooling.
• Kiosk/dedicated devices: Devices locked to specific applications could be repurposed or have controls stripped.

Blast radius: Local to each affected device. No wormable or network-propagation characteristics are described. However, mass exploitation is feasible if a malicious application carrying the exploit is distributed via an app store or sideloading, since no user interaction beyond installation is required.

Exploitation status: No CISA KEV listing. No known in-the-wild exploitation reported. No public proof-of-concept or Nuclei template available. Exploitability is constrained only by the requirement for local access.

Detection Guidance

Detection focuses on anomalous uninstall activity against protected packages and abuse of the Settings application's privileged uninstall path. Because this is a local logic flaw, endpoint telemetry is the primary detection surface (network detection is of limited utility, but a Suricata rule is provided for completeness around ADB/companion-based attack delivery).

Sigma Rule

title: Android Protected Package Uninstall via ApplicationActionButtonsPreferenceController Bypass
id: 3f7c1a92-28641-4b6e-9c2d-8a1f0d5e7b44
status: experimental
description: Detects uninstallation of device-administrator or device-owner protected Android packages that may indicate exploitation of CVE-2026-28641
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-28641
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: android
  service: package_manager
detection:
  selection_event:
    event_type: 'PACKAGE_REMOVED'
  selection_protected:
    package_name|endswith:
      - '.mdm'
      - '.deviceadmin'
      - '.emm'
      - '.vpn'
    is_device_admin: true
  condition: selection_event and selection_protected
falsepositives:
  - Legitimate IT administrator removal during sanctioned decommissioning
level: high

YARA Rule

rule Android_CVE_2026_28641_UninstallBypass
{
    meta:
        description = "Detects Android APKs or DEX files referencing the vulnerable Settings uninstall logic (CVE-2026-28641)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28641"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "shouldDisableUninstallButton" ascii
        $s2 = "ApplicationActionButtonsPreferenceController" ascii
        $s3 = "ApplicationActionButtonsPreferenceController.java" ascii

    condition:
        any of them
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-28641 Android Application Management Permission Bypass - Suspicious ADB Activity"; flow:to_server,established; content:"|43 4e 58 4e|"; content:"shell"; content:"pm uninstall"; nocase; distance:0; within:64; threshold:type both, track by_src, count 3, seconds 60; classtype:attempted-admin; sid:202628641; rev:1; reference:cve,2026-28641;)

Note: This rule targets the delivery/abuse channel (ADB pm uninstall invocations over a companion connection) since the vulnerability itself is a local logic flaw with no distinct network signature.

Elastic Detection

process where event.type == "start" and
  process.name in ("adb", "sh", "app_process") and
  process.args : "pm" and process.args : "uninstall" and
  process.args : ("com.*.mdm", "com.*.deviceadmin", "com.*.emm", "com.*.vpn")

Splunk SPL Query

index=android_logs sourcetype=android:package_manager OR sourcetype=android:syslog
( "PackageManager" AND ("Deleting package" OR "DELETE_PACKAGES") )
OR ( "ApplicationActionButtonsPreferenceController" AND "uninstall" )
| search ("device_admin" OR "device_owner" OR "mdm" OR "emm")
| stats count min(_time) as first_seen max(_time) as last_seen by host, package_name, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="android,cve-2026-28641,">
  <rule id="202641" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">PACKAGE_REMOVED</field>
    <field name="is_device_admin">true</field>
    <description>CVE-2026-28641: Device-admin protected package uninstalled unexpectedly - possible privilege bypass</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source. No vendor fix, workaround, or affected-version list has been published. The following guidance is therefore compiled from general best practices for Android local privilege escalation vulnerabilities and must be validated against the eventual vendor advisory.

1) Immediate mitigations

• Restrict physical and ADB access to managed devices; disable USB debugging on production fleets where not operationally required.
• Enforce strict application allow-listing so that unauthorized/unvetted applications cannot be installed to stage the exploit.
• Deploy mobile threat defense (MTD) tooling that monitors for anomalous uninstall events against device-admin and device-owner protected packages.
• Configure MDM/EMM policies with tamper-detection and self-healing: agents should report and remediate unexpected removal of management components.
• Monitor for repeated or automated uninstall attempts against protected packages via Settings.

2) Patch / upgrade steps

• No patch is currently available. Monitor the Android Security Bulletin from Google and the device OEM (Samsung, Google Pixel, etc.) for an associated CVE patch level.
• Once a fix is released, apply the corresponding Android security patch level to affected devices. Because the vulnerable component is in the platform Settings application (ApplicationActionButtonsPreferenceController.java), remediation will require a platform/framework update rather than an app-store update.
• Track patches at: https://source.android.com/docs/security/bulletin and the Google Android Security Bulletins page.

3) Long-term hardening

• Maintain a supported, currently-patched Android OS baseline across all managed devices; retire end-of-life devices and OS versions.
• Implement defense-in-depth: do not rely on a single UI-layer or client-side authorization decision. Ensure the package manager service independently re-validates authorization for package deletion regardless of UI state.
• Enforce device-owner / work-profile policies that harden against agent tampering and require re-provisioning on removal of critical security components.
• Conduct periodic security reviews of local authorization logic in platform components exposed to application-level callers.

References

1. National Vulnerability Database — CVE-2026-28641: https://nvd.nist.gov/vuln/detail/CVE-2026-28641
2. Android Security Bulletins (patch tracking): https://source.android.com/docs/security/bulletin
3. MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
4. CWE-863 Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
5. CISA Known Exploited Vulnerabilities Catalog (check for future additions): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No known threat actor campaigns and no exploit-in-the-wild evidence have been associated with CVE-2026-28641 at the time of this report. The CVE is not listed in the CISA KEV catalog. No public proof-of-concept, exploit code, or Nuclei template is available.