In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"vanir_signatures": [
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"34854910880770640943891453987352903189",
"264749892964206355649838355894956962301",
"304673577363374716039703101110594054036",
"107949742547000187740488791198714986847",
"328977915378563885872685692144868276377",
"295412554926705776821021117507641116422",
"183591893362354058879566177666366205431",
"330476461316755023431024641578803345215",
"36254379974155902571732649222351772575",
"9587920884115790984585610587438768702",
"338620321886780899685582297984037118305",
"86128062406493483821440438885106143842",
"277645311550121108750893421999807479142",
"319658253681896769291653356404421100343",
"223351614059168228179329373769230237926",
"272957994995246380285613129501273350030",
"305932192253562347615656208108455613895",
"238717445918203344981379426072356108712",
"253734063969270474133472229102664153290",
"4939058405028134664315823005490982557",
"71473833094135736969210811985527416097",
"187037971235717066012100793969029330385",
"95941571494001248005736926895665785474",
"279428913264235352853622689165981720230",
"106360938571089515914338157449455884776",
"178122852397504897822757181748890447288",
"178548753775746457815731070630333848735",
"257427480031179398997616116711769204430",
"259570519201277806214825648501603725298",
"27541020377398267634684997591110283237",
"335443154102825094948681078060688831444",
"222681976180483715420127857801913007018",
"14014523145395490832043787297885928138",
"189820370024616235250031468713076274654",
"261042922997886905976196670589502696223",
"186615983231440608237619667771514968849",
"43954734863903777673932986131448341347",
"59648419938540819982370581478281602517",
"227087085257813489440910975360313758902",
"199795213785025984236604802491111118274",
"134548301395890134171277353738233316732",
"6669887734946403218399241988460817471",
"338840563052995884737321872962960831514",
"178104785530842527715066808790238302244",
"208633344772049107873523690307855690291",
"207922513075474538380862177962542954639",
"259089546223717684830267845072582701968",
"185286214932117722448057589901768137396",
"252103572273984108381200696083923175010",
"287614278452942286285638785574914136102",
"162869470531017275765918621219980970106",
"182399054577288392625855651137803900760",
"42941520593185482797446598093676143163",
"148175255917281584791331291038036740090",
"142581681033398117339400590576371706763",
"37975191360961260576196524754234777344",
"317041239835130071832763382238859876324",
"158314174392830520030701022434258538773",
"160414216852129397321475862409152548943",
"43145313559660741477547123542246058985",
"197698277449216413349428287620449604387",
"108948706531128309018017111177664441980",
"49159672759381857532162873557320107176",
"89230475725491075994137658139699356390",
"125640006700090693900374513810381853262",
"322377808025438592340942062893117621068",
"268973655384056199582643425854275287870",
"236611243525403157701291885110884032289",
"41111946947788030947243771489700972253",
"139704518681540534819627765464202675762",
"37729000340062693403313139815065488484"
]
},
"id": "ASB-A-392614489-0b588831",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/packages/modules/AppSearch/+/b1d2fcc8b39be70b99e783ee90428d4958231bc9",
"target": {
"file": "service/java/com/android/server/appsearch/AppSearchManagerService.java"
}
},
{
"digest": {
"length": 1874.0,
"function_hash": "193786257227887386997519336366299239020"
},
"id": "ASB-A-392614489-81a31584",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/packages/modules/AppSearch/+/b1d2fcc8b39be70b99e783ee90428d4958231bc9",
"target": {
"function": "executeAppFunction",
"file": "service/java/com/android/server/appsearch/AppSearchManagerService.java"
}
}
],
"fixes": [
"https://android.googlesource.com/platform/packages/modules/AppSearch/+/b1d2fcc8b39be70b99e783ee90428d4958231bc9"
],
"types": [
"EoP"
],
"spl": "2025-09-01",
"severity": "High"
}