ASB-A-407764858

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-407764858.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-407764858
Aliases
Published
2025-09-01T00:00:00Z
Modified
2026-03-09T15:09:45.114269Z
Summary
[none]
Details

In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/modules/IntentResolver

Package

Name
platform/packages/modules/IntentResolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-next:0
Fixed
16-next:2025-09-01

Affected versions

Other
16-next

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e"
    ],
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-7914f45d",
            "digest": {
                "length": 5642.0,
                "function_hash": "162876921944084724772787647666407605162"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "initialize"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-b46bc1ec",
            "digest": {
                "length": 1983.0,
                "function_hash": "245014903818687579480104451141464789506"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "recreatePagerAdapter"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-d636f719",
            "digest": {
                "length": 1040.0,
                "function_hash": "269489128610763341285638470587810319166"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "createMultiProfilePagerAdapter"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-ee17de06",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "215333141439614203753758609164174502322",
                    "92686852643144425174299857766869900904",
                    "185571118409943467701918122230630182350",
                    "299328347200442535910218016921829993374",
                    "215333141439614203753758609164174502322",
                    "92686852643144425174299857766869900904",
                    "263737943769798527988401749923504940804",
                    "83731266336373756401423512545034306967",
                    "131568089663822273778780646859032046846",
                    "228286212397013514343482128007987050757",
                    "293605670750163784902857303051406727315",
                    "107495251614009311720607524365834370070",
                    "173754968742481079859037967833701907271",
                    "259764565464088187677568724754000298186",
                    "9995448754546046436225691572829368258",
                    "166514408147717829439730404577729472986",
                    "108778651122802310635196509103581479526",
                    "27242652280024949580262926206255132154",
                    "309496245061920905911472417094546533046",
                    "240184056093340782984785804047562560688",
                    "88769382919936861286729784349501338228",
                    "83485324021357080616177964679131411457",
                    "319173807185048622048758937182457274688",
                    "36615385033742190461066328375264598620"
                ]
            },
            "signature_type": "Line",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"
platform/packages/modules/IntentResolver

Package

Name
platform/packages/modules/IntentResolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe"
    ],
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-18b03e0f",
            "digest": {
                "length": 1551.0,
                "function_hash": "47385744904952644988629242753947747582"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "recreatePagerAdapter"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-32c28f4e",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "159320662772587594802989918164026606043",
                    "249952864840277843374201996634089409644",
                    "185571118409943467701918122230630182350",
                    "299328347200442535910218016921829993374",
                    "159320662772587594802989918164026606043",
                    "249952864840277843374201996634089409644",
                    "263737943769798527988401749923504940804",
                    "83731266336373756401423512545034306967",
                    "188384057836139474750289453774664245777",
                    "173417142359944964570386983870238641061",
                    "293605670750163784902857303051406727315",
                    "107495251614009311720607524365834370070",
                    "173754968742481079859037967833701907271",
                    "259764565464088187677568724754000298186",
                    "9995448754546046436225691572829368258",
                    "129862893307899221670768442190490512679",
                    "12242478898106145515416046652646761632",
                    "82305941197215487350735843313308597617",
                    "287623922150154831874068837120182263581",
                    "3949598570500360823143437329026834701",
                    "119056791189994695887283639616722706116",
                    "88769382919936861286729784349501338228",
                    "83485324021357080616177964679131411457",
                    "319173807185048622048758937182457274688",
                    "36615385033742190461066328375264598620"
                ]
            },
            "signature_type": "Line",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-9f98d4a4",
            "digest": {
                "length": 5193.0,
                "function_hash": "277441329241121412496619467039944055635"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "initialize"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-de22d897",
            "digest": {
                "length": 1144.0,
                "function_hash": "329672116372703837246512655755336984446"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "createMultiProfilePagerAdapter"
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"
platform/packages/modules/IntentResolver

Package

Name
platform/packages/modules/IntentResolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2025-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01"
    ],
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-0622c816",
            "digest": {
                "length": 1040.0,
                "function_hash": "269489128610763341285638470587810319166"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "createMultiProfilePagerAdapter"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-0ddde6c3",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "215333141439614203753758609164174502322",
                    "92686852643144425174299857766869900904",
                    "185571118409943467701918122230630182350",
                    "299328347200442535910218016921829993374",
                    "215333141439614203753758609164174502322",
                    "92686852643144425174299857766869900904",
                    "263737943769798527988401749923504940804",
                    "83731266336373756401423512545034306967",
                    "131568089663822273778780646859032046846",
                    "228286212397013514343482128007987050757",
                    "293605670750163784902857303051406727315",
                    "107495251614009311720607524365834370070",
                    "173754968742481079859037967833701907271",
                    "259764565464088187677568724754000298186",
                    "9995448754546046436225691572829368258",
                    "166514408147717829439730404577729472986",
                    "108778651122802310635196509103581479526",
                    "27242652280024949580262926206255132154",
                    "309496245061920905911472417094546533046",
                    "240184056093340782984785804047562560688",
                    "88769382919936861286729784349501338228",
                    "83485324021357080616177964679131411457",
                    "319173807185048622048758937182457274688",
                    "36615385033742190461066328375264598620"
                ]
            },
            "signature_type": "Line",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-d50d9f8d",
            "digest": {
                "length": 5027.0,
                "function_hash": "26306566549522124209316819212510561251"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "initialize"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-e4c86595",
            "digest": {
                "length": 1999.0,
                "function_hash": "141190872899214642077379963305813886430"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "recreatePagerAdapter"
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2025-09-01

Affected versions

Other
13

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/07f1d8bda4dee82ec3f6e9ee387ec9c58648f2a6"
    ],
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/07f1d8bda4dee82ec3f6e9ee387ec9c58648f2a6",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-83acb509",
            "digest": {
                "length": 439.0,
                "function_hash": "154719132187196818922568902695499015179"
            },
            "signature_type": "Function",
            "target": {
                "file": "core/java/com/android/internal/app/ChooserActivity.java",
                "function": "createChooserMultiProfilePagerAdapterForTwoProfiles"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/07f1d8bda4dee82ec3f6e9ee387ec9c58648f2a6",
            "deprecated": false,
            "signature_version": "v1",
            "match_only_versions": [
                "13"
            ],
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "303200336292687948470798038711625385160",
                    "312116394965678215848163713502176217651",
                    "150956291927727367153030701760209362946",
                    "56988950160021802968717575176214961445",
                    "208226744332229224564731370192207040976",
                    "21016183867967356869875992074226210646",
                    "233072465952685026719431423238787540268",
                    "58317128744481872808735684339114521534",
                    "117577704333210749895440127921391488041",
                    "54716239563214829348819313860819299706",
                    "192971077688858538798706176302956457198",
                    "220618106892077315522619458348290676690",
                    "265098355571209063931064720029194008857",
                    "79792159623743412109835793969545414772",
                    "294433187559997815648810400875250291234",
                    "249826123069047202027451074380779988875"
                ]
            },
            "id": "ASB-A-407764858-a74b1332",
            "signature_type": "Line",
            "target": {
                "file": "core/java/com/android/internal/app/ChooserActivity.java"
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"
platform/packages/modules/IntentResolver

Package

Name
platform/packages/modules/IntentResolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2025-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e94664d31320aeef70d25218f51d89418b965e1e"
    ],
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e94664d31320aeef70d25218f51d89418b965e1e",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-f597198b",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "241690411752982290529145353848693069971",
                    "93667484321929739672812455931140241550",
                    "248332587967891437381698483150003949526",
                    "263679993672820044546197025256300575960",
                    "233916810246275409202968732652250779959",
                    "219612390083847085112809178634900296948",
                    "56988950160021802968717575176214961445",
                    "208226744332229224564731370192207040976",
                    "21016183867967356869875992074226210646",
                    "233072465952685026719431423238787540268",
                    "148452800304778791217052167309346886950",
                    "220618106892077315522619458348290676690",
                    "265098355571209063931064720029194008857",
                    "79792159623743412109835793969545414772"
                ]
            },
            "signature_type": "Line",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            }
        },
        {
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e94664d31320aeef70d25218f51d89418b965e1e",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407764858-fb9affdd",
            "digest": {
                "length": 518.0,
                "function_hash": "35145605575209271686893571447086542240"
            },
            "signature_type": "Function",
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java",
                "function": "createChooserMultiProfilePagerAdapterForTwoProfiles"
            }
        }
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"