CVE-2026-28663

CVE-2026-28663 is a BAL (Background Activity Launch) bypass in Android's LauncherAppsService.java, specifically in the buildIntentSenderForUser method. An attacker can launch an activity from the background, leading to local escalation of privilege without requiring additional execution privilege...