ASB-A-262884935

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-262884935.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-262884935
Aliases
  • A-262884935
  • CVE-2026-28597
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T17:11:14Z
Summary
[none]
Details

In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298",
        "https://android.googlesource.com/platform/frameworks/base/+/643b15430b92b743d69ab9d873dc206c213f3b26"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "49714436608044671305293876268688011751",
                    "27235926812117504666227503456781838858",
                    "152131684056357529303359116694599025110",
                    "192237261357507002612339171188052603944",
                    "140495636727712672716440343884166268756",
                    "157719352045282315778688066858686201191",
                    "107884727821770368367347544731045814570",
                    "89816167525425443615835220578845872850"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-1cded88a",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriPermission.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "96375408898447538659536913358771750766",
                "length":  1656
            },
            "id":  "ASB-A-262884935-3660e61e",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/643b15430b92b743d69ab9d873dc206c213f3b26",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java",
                "function":  "writeGrantedUriPermissionWithSnapshot"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "208066064267241960959440941019057948997",
                    "313737864995091110429460964588625254278",
                    "14117458227292577305935911113212513881",
                    "238051827951220167354838224651315039593",
                    "188418041337602474075491705044948425522",
                    "271409270120930447055350760298209320538",
                    "127777762670012129513346807589712012754",
                    "77828897691903140610541870309814868835",
                    "124206579015600549164449103829268990919",
                    "173509816950935623162542703793514283472",
                    "276836399207426780002331109902106526021",
                    "260997651908002305298770814439457104666",
                    "167984905105034397083832491026409320181",
                    "113223502937592717980155175581986064747",
                    "25551873650588914003464304440811981086",
                    "10360057136569032732299731456835186082",
                    "223611691733174629427932502533012916570",
                    "46989173182728006183241236139019195354",
                    "137577992719925689576038138992345831392",
                    "245096642054775315075274008460296428961",
                    "263901127997092598003410834345461647047"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-b1bd5c19",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/643b15430b92b743d69ab9d873dc206c213f3b26",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "58670020022276940087647970307836601199",
                    "315148219331921030566269997373448571861",
                    "192086011035144630534812329229620258818",
                    "260287082417008909222784211034295258968",
                    "265790801120572393218953429802584020240",
                    "70653557675873499691925765785249816034",
                    "194811434092391301974013545190413141185",
                    "33150181908758360640020837957982183397",
                    "312895007790225659854354312298784159199",
                    "108408552910146826053673955449778310358",
                    "137696438128835532204806381809806166686",
                    "80797616084554163508356591809675752271",
                    "52950164070929098033575560126105451061",
                    "191019419916906064687848028646737864967",
                    "208333260615160174296918704248449711573",
                    "120723792442756082647344117031437317838",
                    "196131753133668671130504834467997254354",
                    "83127344736328599676001642467244968833",
                    "104119711074550133945869178538437504971",
                    "224275535601845120267244912199302071890",
                    "240785075554445538493757802638685194054",
                    "188146902918788390764632983646377252055",
                    "142361514505696748380105095567532808199",
                    "123664273482389585516345188777816474886",
                    "397119352004599082162725205329512310",
                    "135765611353314023128529939795503747805",
                    "207213090650747517810620129618804091220",
                    "271911949780274440842928288276957635384"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-c3678b7b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "275695760622047620742569185681751300143",
                "length":  1673
            },
            "id":  "ASB-A-262884935-faa8f7a9",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java",
                "function":  "writeGrantedUriPermissions"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "275695760622047620742569185681751300143",
                "length":  1673
            },
            "id":  "ASB-A-262884935-9eccac08",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java",
                "function":  "writeGrantedUriPermissions"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "290186854208823290511265801338864998030",
                    "286340809122951368854389731249383566301",
                    "53154135960009604216752095956444432126",
                    "140495636727712672716440343884166268756",
                    "157719352045282315778688066858686201191",
                    "107884727821770368367347544731045814570",
                    "89816167525425443615835220578845872850"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-c2e3e075",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriPermission.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "58670020022276940087647970307836601199",
                    "315148219331921030566269997373448571861",
                    "192086011035144630534812329229620258818",
                    "260287082417008909222784211034295258968",
                    "265790801120572393218953429802584020240",
                    "70653557675873499691925765785249816034",
                    "194811434092391301974013545190413141185",
                    "120723792442756082647344117031437317838",
                    "196131753133668671130504834467997254354",
                    "83127344736328599676001642467244968833",
                    "104119711074550133945869178538437504971",
                    "224275535601845120267244912199302071890",
                    "240785075554445538493757802638685194054",
                    "188146902918788390764632983646377252055",
                    "142361514505696748380105095567532808199",
                    "123664273482389585516345188777816474886",
                    "397119352004599082162725205329512310",
                    "135765611353314023128529939795503747805",
                    "207213090650747517810620129618804091220",
                    "271911949780274440842928288276957635384"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-f25b13ba",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "49714436608044671305293876268688011751",
                    "27235926812117504666227503456781838858",
                    "152131684056357529303359116694599025110",
                    "192237261357507002612339171188052603944",
                    "140495636727712672716440343884166268756",
                    "157719352045282315778688066858686201191",
                    "107884727821770368367347544731045814570",
                    "89816167525425443615835220578845872850"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-27d38d64",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriPermission.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "275695760622047620742569185681751300143",
                "length":  1673
            },
            "id":  "ASB-A-262884935-82a01014",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java",
                "function":  "writeGrantedUriPermissions"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "58670020022276940087647970307836601199",
                    "315148219331921030566269997373448571861",
                    "192086011035144630534812329229620258818",
                    "260287082417008909222784211034295258968",
                    "265790801120572393218953429802584020240",
                    "70653557675873499691925765785249816034",
                    "194811434092391301974013545190413141185",
                    "120723792442756082647344117031437317838",
                    "196131753133668671130504834467997254354",
                    "83127344736328599676001642467244968833",
                    "104119711074550133945869178538437504971",
                    "224275535601845120267244912199302071890",
                    "240785075554445538493757802638685194054",
                    "188146902918788390764632983646377252055",
                    "142361514505696748380105095567532808199",
                    "123664273482389585516345188777816474886",
                    "397119352004599082162725205329512310",
                    "135765611353314023128529939795503747805",
                    "207213090650747517810620129618804091220",
                    "271911949780274440842928288276957635384"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-a2f61b5e",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "58670020022276940087647970307836601199",
                    "315148219331921030566269997373448571861",
                    "192086011035144630534812329229620258818",
                    "260287082417008909222784211034295258968",
                    "265790801120572393218953429802584020240",
                    "70653557675873499691925765785249816034",
                    "194811434092391301974013545190413141185",
                    "120723792442756082647344117031437317838",
                    "196131753133668671130504834467997254354",
                    "83127344736328599676001642467244968833",
                    "104119711074550133945869178538437504971",
                    "224275535601845120267244912199302071890",
                    "240785075554445538493757802638685194054",
                    "188146902918788390764632983646377252055",
                    "142361514505696748380105095567532808199",
                    "123664273482389585516345188777816474886",
                    "397119352004599082162725205329512310",
                    "135765611353314023128529939795503747805",
                    "207213090650747517810620129618804091220",
                    "271911949780274440842928288276957635384"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-17c98f6e",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "275695760622047620742569185681751300143",
                "length":  1673
            },
            "id":  "ASB-A-262884935-1d4688c8",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java",
                "function":  "writeGrantedUriPermissions"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "49714436608044671305293876268688011751",
                    "27235926812117504666227503456781838858",
                    "152131684056357529303359116694599025110",
                    "192237261357507002612339171188052603944",
                    "140495636727712672716440343884166268756",
                    "157719352045282315778688066858686201191",
                    "107884727821770368367347544731045814570",
                    "89816167525425443615835220578845872850"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-6a7ea539",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriPermission.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "58670020022276940087647970307836601199",
                    "315148219331921030566269997373448571861",
                    "192086011035144630534812329229620258818",
                    "260287082417008909222784211034295258968",
                    "265790801120572393218953429802584020240",
                    "70653557675873499691925765785249816034",
                    "194811434092391301974013545190413141185",
                    "120723792442756082647344117031437317838",
                    "196131753133668671130504834467997254354",
                    "83127344736328599676001642467244968833",
                    "104119711074550133945869178538437504971",
                    "224275535601845120267244912199302071890",
                    "240785075554445538493757802638685194054",
                    "188146902918788390764632983646377252055",
                    "142361514505696748380105095567532808199",
                    "123664273482389585516345188777816474886",
                    "397119352004599082162725205329512310",
                    "135765611353314023128529939795503747805",
                    "207213090650747517810620129618804091220",
                    "271911949780274440842928288276957635384"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-6bdd18fc",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "275695760622047620742569185681751300143",
                "length":  1673
            },
            "id":  "ASB-A-262884935-886f39f9",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriGrantsManagerService.java",
                "function":  "writeGrantedUriPermissions"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "290186854208823290511265801338864998030",
                    "286340809122951368854389731249383566301",
                    "53154135960009604216752095956444432126",
                    "140495636727712672716440343884166268756",
                    "157719352045282315778688066858686201191",
                    "107884727821770368367347544731045814570",
                    "89816167525425443615835220578845872850"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-262884935-8faa9805",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c",
            "target":  {
                "file":  "services/core/java/com/android/server/uri/UriPermission.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"