ASB-A-349318333

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-349318333.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-349318333
Aliases
  • A-349318333
  • CVE-2026-58836
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T17:11:21Z
Summary
[none]
Details

In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/c06b539f3109383224362ce9ab567a4c78c383e1"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "96552639340851458938414067618559339265",
                "length":  3824
            },
            "id":  "ASB-A-349318333-40b7f871",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/c06b539f3109383224362ce9ab567a4c78c383e1",
            "target":  {
                "file":  "services/core/java/com/android/server/pm/InstallPackageHelper.java",
                "function":  "handlePackagePostInstall"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "225655952136627345140544747043371473420",
                    "181643256137594243119830058869882159526",
                    "201339850563738457002402554786183575808",
                    "339557525162858247196771881320633270088",
                    "28928597375337600204222332327275969644",
                    "107115069225965149447871763730278748069",
                    "219982860852155744088814255327918757439",
                    "106559757152006970295611668040062029025",
                    "128304521799675867583940051458682298493",
                    "250557203788059399280682980473833803638",
                    "266987544006947530092500999493404866486",
                    "102332067067627989104450103423287840146",
                    "101986957911186362569484053996623160600",
                    "244125084856819352952595829882912148068",
                    "106693184872776943290393094224511021665"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-349318333-ed232568",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/c06b539f3109383224362ce9ab567a4c78c383e1",
            "target":  {
                "file":  "services/core/java/com/android/server/pm/InstallPackageHelper.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-349318333.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/30083b50c1f18bf617459e5415da03a29366ea60"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "63388427733452695298063355201745534812",
                "length":  4015
            },
            "id":  "ASB-A-349318333-b8903094",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/30083b50c1f18bf617459e5415da03a29366ea60",
            "target":  {
                "file":  "services/core/java/com/android/server/pm/InstallPackageHelper.java",
                "function":  "handlePackagePostInstall"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "225655952136627345140544747043371473420",
                    "181643256137594243119830058869882159526",
                    "201339850563738457002402554786183575808",
                    "339557525162858247196771881320633270088",
                    "28928597375337600204222332327275969644",
                    "107115069225965149447871763730278748069",
                    "219982860852155744088814255327918757439",
                    "106559757152006970295611668040062029025",
                    "128304521799675867583940051458682298493",
                    "250557203788059399280682980473833803638",
                    "266987544006947530092500999493404866486",
                    "102332067067627989104450103423287840146",
                    "101986957911186362569484053996623160600",
                    "244125084856819352952595829882912148068",
                    "106693184872776943290393094224511021665"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-349318333-e428107b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/30083b50c1f18bf617459e5415da03a29366ea60",
            "target":  {
                "file":  "services/core/java/com/android/server/pm/InstallPackageHelper.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-349318333.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/a3a6a181f9a634c937e52ef39c181277a1e0f790"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "185064879593035324171915782227754279035",
                "length":  3782
            },
            "id":  "ASB-A-349318333-15531f20",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/a3a6a181f9a634c937e52ef39c181277a1e0f790",
            "target":  {
                "file":  "services/core/java/com/android/server/pm/InstallPackageHelper.java",
                "function":  "handlePackagePostInstall"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "225655952136627345140544747043371473420",
                    "181643256137594243119830058869882159526",
                    "201339850563738457002402554786183575808",
                    "339557525162858247196771881320633270088",
                    "28928597375337600204222332327275969644",
                    "107115069225965149447871763730278748069",
                    "219982860852155744088814255327918757439",
                    "106559757152006970295611668040062029025",
                    "128304521799675867583940051458682298493",
                    "250557203788059399280682980473833803638",
                    "266987544006947530092500999493404866486",
                    "102332067067627989104450103423287840146",
                    "101986957911186362569484053996623160600",
                    "244125084856819352952595829882912148068",
                    "106693184872776943290393094224511021665"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-349318333-d4b8d4ef",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/a3a6a181f9a634c937e52ef39c181277a1e0f790",
            "target":  {
                "file":  "services/core/java/com/android/server/pm/InstallPackageHelper.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-349318333.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/00822bb857ac91e09b10169a9babc075e94a1d3a"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "225655952136627345140544747043371473420",
                    "181643256137594243119830058869882159526",
                    "201339850563738457002402554786183575808",
                    "339557525162858247196771881320633270088",
                    "28928597375337600204222332327275969644",
                    "107115069225965149447871763730278748069",
                    "219982860852155744088814255327918757439",
                    "106559757152006970295611668040062029025",
                    "128304521799675867583940051458682298493",
                    "250557203788059399280682980473833803638",
                    "266987544006947530092500999493404866486",
                    "102332067067627989104450103423287840146",
                    "101986957911186362569484053996623160600",
                    "244125084856819352952595829882912148068",
                    "106693184872776943290393094224511021665"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-349318333-9f38084b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/00822bb857ac91e09b10169a9babc075e94a1d3a",
            "target":  {
                "file":  "services/core/java/com/android/server/pm/InstallPackageHelper.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "96552639340851458938414067618559339265",
                "length":  3824
            },
            "id":  "ASB-A-349318333-cc53fcde",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/00822bb857ac91e09b10169a9babc075e94a1d3a",
            "target":  {
                "file":  "services/core/java/com/android/server/pm/InstallPackageHelper.java",
                "function":  "handlePackagePostInstall"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-349318333.json"