ASB-A-329233015

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-329233015.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-329233015
Aliases
  • A-329233015
  • CVE-2026-28613
Published
2026-09-01T00:00:00Z
Modified
2026-09-08T15:39:03Z
Summary
[none]
Details

In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References

Affected packages

Android
platform/packages/apps/TV

Package

Name
platform/packages/apps/TV

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/TV/+/415d636eb465a20ddcdd12244e675cdf18971f7b"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "125903331997634824313909372045928403101",
                    "331113026861862374895474285209768846213",
                    "338327705831313875220268959582057108590",
                    "11809828591642118921488302570555839644",
                    "187140409983236949167563400933486793273",
                    "224521677386353263215494778810229768251",
                    "280341753752157569741377043583314714858",
                    "212711621034491089131739578336956106022",
                    "178991285254059016134939756305430537558"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-329233015-e06ad465",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/415d636eb465a20ddcdd12244e675cdf18971f7b",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "196249853139039549830237051170712129000",
                "length": 1363
            },
            "id": "ASB-A-329233015-fc4eea82",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/415d636eb465a20ddcdd12244e675cdf18971f7b",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java",
                "function": "initAppLinkTypeAndIntent"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"
platform/packages/apps/TV

Package

Name
platform/packages/apps/TV

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/TV/+/2a006313f82e6339b71fb3f7090c40d44bf28d2f"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "125903331997634824313909372045928403101",
                    "331113026861862374895474285209768846213",
                    "338327705831313875220268959582057108590",
                    "11809828591642118921488302570555839644",
                    "187140409983236949167563400933486793273",
                    "224521677386353263215494778810229768251",
                    "280341753752157569741377043583314714858",
                    "212711621034491089131739578336956106022",
                    "178991285254059016134939756305430537558"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-329233015-35876192",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/2a006313f82e6339b71fb3f7090c40d44bf28d2f",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "196249853139039549830237051170712129000",
                "length": 1363
            },
            "id": "ASB-A-329233015-e0758b38",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/2a006313f82e6339b71fb3f7090c40d44bf28d2f",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java",
                "function": "initAppLinkTypeAndIntent"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"
platform/packages/apps/TV

Package

Name
platform/packages/apps/TV

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/TV/+/a0ee38f7a4f4560fbb9b69b53ff02318eaeb645a"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "125903331997634824313909372045928403101",
                    "331113026861862374895474285209768846213",
                    "338327705831313875220268959582057108590",
                    "11809828591642118921488302570555839644",
                    "187140409983236949167563400933486793273",
                    "224521677386353263215494778810229768251",
                    "280341753752157569741377043583314714858",
                    "212711621034491089131739578336956106022",
                    "178991285254059016134939756305430537558"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-329233015-82f42b71",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/a0ee38f7a4f4560fbb9b69b53ff02318eaeb645a",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "196249853139039549830237051170712129000",
                "length": 1363
            },
            "id": "ASB-A-329233015-d829e703",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/a0ee38f7a4f4560fbb9b69b53ff02318eaeb645a",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java",
                "function": "initAppLinkTypeAndIntent"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"
platform/packages/apps/TV

Package

Name
platform/packages/apps/TV

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/TV/+/3cd46ba2b7d4da6ed42fba704bd043e0775e6b20"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "196249853139039549830237051170712129000",
                "length": 1363
            },
            "id": "ASB-A-329233015-7cfd7b59",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/3cd46ba2b7d4da6ed42fba704bd043e0775e6b20",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java",
                "function": "initAppLinkTypeAndIntent"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "125903331997634824313909372045928403101",
                    "331113026861862374895474285209768846213",
                    "338327705831313875220268959582057108590",
                    "11809828591642118921488302570555839644",
                    "187140409983236949167563400933486793273",
                    "224521677386353263215494778810229768251",
                    "280341753752157569741377043583314714858",
                    "212711621034491089131739578336956106022",
                    "178991285254059016134939756305430537558"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-329233015-c77ffae1",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/3cd46ba2b7d4da6ed42fba704bd043e0775e6b20",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"
platform/packages/apps/TV

Package

Name
platform/packages/apps/TV

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/TV/+/18b8cdfa88c81d5304a4697733c3c639bc480727"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "196249853139039549830237051170712129000",
                "length": 1363
            },
            "id": "ASB-A-329233015-e395d564",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/18b8cdfa88c81d5304a4697733c3c639bc480727",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java",
                "function": "initAppLinkTypeAndIntent"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "125903331997634824313909372045928403101",
                    "331113026861862374895474285209768846213",
                    "338327705831313875220268959582057108590",
                    "11809828591642118921488302570555839644",
                    "187140409983236949167563400933486793273",
                    "224521677386353263215494778810229768251",
                    "280341753752157569741377043583314714858",
                    "212711621034491089131739578336956106022",
                    "178991285254059016134939756305430537558"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-329233015-e938062e",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/18b8cdfa88c81d5304a4697733c3c639bc480727",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"
platform/packages/apps/TV

Package

Name
platform/packages/apps/TV

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/TV/+/7648d0a746a191612c97ac9c581c1ebc3b13fa2a"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "125903331997634824313909372045928403101",
                    "331113026861862374895474285209768846213",
                    "338327705831313875220268959582057108590",
                    "11809828591642118921488302570555839644",
                    "187140409983236949167563400933486793273",
                    "224521677386353263215494778810229768251",
                    "280341753752157569741377043583314714858",
                    "212711621034491089131739578336956106022",
                    "178991285254059016134939756305430537558"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-329233015-194518ee",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/7648d0a746a191612c97ac9c581c1ebc3b13fa2a",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "196249853139039549830237051170712129000",
                "length": 1363
            },
            "id": "ASB-A-329233015-4c5db74f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/TV/+/7648d0a746a191612c97ac9c581c1ebc3b13fa2a",
            "target": {
                "file": "src/com/android/tv/data/ChannelImpl.java",
                "function": "initAppLinkTypeAndIntent"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"