CVE-2026-28636

In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28636

A privilege escalation flaw (CWE-269 ) exists in the Documents UI component of Android versions 13, 14, 15, and 16 . The vulnerability is located in setupLayout of PickActivity.java and stems from a confused deputy issue, which allows local applications to bypass the "Install unknown apps" securi...