In queryInternal of MmsSmsProvider.java, there is a possible way to access MMS/SMS data across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "188880999255660073179596386710294385453",
"length": 8050
},
"id": "ASB-A-418776187-62a83292",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "queryInternal"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115852418371893726666298693186447937427",
"length": 1201
},
"id": "ASB-A-418776187-88e507f8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "getTextSearchQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"136802329616135471664233362941077006905",
"28691711636404942943129151565909700338",
"176295319073431672072655273712129123675",
"130890650755251801856216703833007809773",
"57656358259527680442444063474892333218",
"234444472540445350366806441521020852282",
"27672492891490450420418580039021852511",
"277699879074650758698282896124363268511",
"324430731079907372259348064736481606791",
"206636778078385431955076262011548960319",
"166294208799980148403719571268555688036",
"334714996978313036750087516054996875547",
"17009633391817132282331189091451115850",
"64043474417064679059821076242644881329",
"167904958192380504628677465047090773613",
"50851629648608132099150825168494814799",
"223388432775768910920057459329326454011",
"331591775732554817348856681836996512467",
"54401603461502414977538245383273933042",
"127440859949272792099447129142163832073",
"82508640193944607438434798999793587036",
"141118416137438315961463853621328794322",
"222426755692545485626279487218058586761",
"190423102012389054144931852614611045973",
"179878819981819191237184392893219388408",
"339646452202614701305698831522823050617",
"146200940727979671702208086640715949987",
"45976166416491864126854898888965939775",
"179404774849306018163078825074439384476",
"267592098320588670023594456550655836403",
"147982133334808742802936746850746640097",
"95216263369590486423596158446173485346",
"172690904525401890545773017015647306141",
"191618558072125599522074271844249386973",
"230741775141976062468833322014044448508",
"39168555688690438076035169341504214971",
"295694830112681881210904075318803043711",
"169525461909817483184047107653610640876",
"666454788699359580011857178232819547",
"109651799666511754100999079828735677537",
"4146283051387891575434168388216485067",
"223337884050438011219025392804223033222",
"169830670116710176435960193379510138940",
"124292021272379332837343334135053194440",
"218669114776656206751905706704368310351",
"57088269784231425612392639252025857389",
"126108984648702824450998775405599655909",
"248589592794879054592553943597856810635",
"63932034346910116701132762504166657525",
"67243975172799998017629671600115478660",
"321637405442106200371341651925005292639",
"214285540124007229306558810116208662907"
],
"threshold": 0.9
},
"id": "ASB-A-418776187-ef753f98",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"136802329616135471664233362941077006905",
"28691711636404942943129151565909700338",
"176295319073431672072655273712129123675",
"130890650755251801856216703833007809773",
"235475316097154250275043340527786554024",
"242782141094188487992674006370258409236",
"189149550968798635948326799958387587076",
"116262057794230151559796087261446461593",
"125325987970811906526294499378337441650",
"176950685375159166537452584878010797564",
"46954059598559379852697476943871151861",
"121660500326833587347066330108700255257",
"197226415908754595787679376049925258294",
"175144240918627696706389043163020705352",
"20436973763401286396321817216566876575",
"330367912133000650234416714133209340575",
"89643941187703297761987712821495745751",
"179878819981819191237184392893219388408",
"339646452202614701305698831522823050617",
"159396926117267726652544130574558533213",
"144170050329981353372966156665661183281",
"262068676558711509831217486618013363205",
"68194612853305562036906942959198182537",
"147982133334808742802936746850746640097",
"188287710402255797747315035948801106767",
"284101723383781290022219617540114419816",
"293177386928530964471547645786252086508",
"15779983341982286451828558391328868055",
"39168555688690438076035169341504214971",
"107445837503732636214255104317215840241",
"310968217894393759923981334338335408596",
"169186351662557925778398158417814260479",
"129252227524841832480292152920369279699",
"44239815851079422320523672381900275345",
"223337884050438011219025392804223033222",
"169830670116710176435960193379510138940",
"124292021272379332837343334135053194440",
"218669114776656206751905706704368310351",
"57088269784231425612392639252025857389",
"126108984648702824450998775405599655909",
"255617379624037692455693671586636871365",
"292265071202787058271372941685282380925",
"53860944455546604474692588456365778634",
"113117854547287017753798240285429774943"
],
"threshold": 0.9
},
"id": "ASB-A-418776187-446515ad",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "110241711838873038651601426381532248153",
"length": 907
},
"id": "ASB-A-418776187-ba78c27f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "getTextSearchQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "168282920648873990586701718012200262781",
"length": 7006
},
"id": "ASB-A-418776187-f8754e0b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "query"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "110241711838873038651601426381532248153",
"length": 907
},
"id": "ASB-A-418776187-29575c51",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "getTextSearchQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"136802329616135471664233362941077006905",
"28691711636404942943129151565909700338",
"176295319073431672072655273712129123675",
"130890650755251801856216703833007809773",
"235475316097154250275043340527786554024",
"242782141094188487992674006370258409236",
"189149550968798635948326799958387587076",
"116262057794230151559796087261446461593",
"125325987970811906526294499378337441650",
"176950685375159166537452584878010797564",
"46954059598559379852697476943871151861",
"121660500326833587347066330108700255257",
"197226415908754595787679376049925258294",
"175144240918627696706389043163020705352",
"20436973763401286396321817216566876575",
"330367912133000650234416714133209340575",
"89643941187703297761987712821495745751",
"179878819981819191237184392893219388408",
"339646452202614701305698831522823050617",
"159396926117267726652544130574558533213",
"144170050329981353372966156665661183281",
"262068676558711509831217486618013363205",
"68194612853305562036906942959198182537",
"147982133334808742802936746850746640097",
"188287710402255797747315035948801106767",
"284101723383781290022219617540114419816",
"293177386928530964471547645786252086508",
"15779983341982286451828558391328868055",
"39168555688690438076035169341504214971",
"107445837503732636214255104317215840241",
"310968217894393759923981334338335408596",
"169186351662557925778398158417814260479",
"129252227524841832480292152920369279699",
"44239815851079422320523672381900275345",
"223337884050438011219025392804223033222",
"169830670116710176435960193379510138940",
"124292021272379332837343334135053194440",
"218669114776656206751905706704368310351",
"57088269784231425612392639252025857389",
"126108984648702824450998775405599655909",
"255617379624037692455693671586636871365",
"292265071202787058271372941685282380925",
"53860944455546604474692588456365778634",
"113117854547287017753798240285429774943"
],
"threshold": 0.9
},
"id": "ASB-A-418776187-72526307",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "168282920648873990586701718012200262781",
"length": 7006
},
"id": "ASB-A-418776187-c9111547",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "query"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "110241711838873038651601426381532248153",
"length": 907
},
"id": "ASB-A-418776187-54b093a7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "getTextSearchQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "168282920648873990586701718012200262781",
"length": 7006
},
"id": "ASB-A-418776187-764e4a67",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "query"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"136802329616135471664233362941077006905",
"28691711636404942943129151565909700338",
"176295319073431672072655273712129123675",
"130890650755251801856216703833007809773",
"235475316097154250275043340527786554024",
"242782141094188487992674006370258409236",
"189149550968798635948326799958387587076",
"116262057794230151559796087261446461593",
"125325987970811906526294499378337441650",
"176950685375159166537452584878010797564",
"46954059598559379852697476943871151861",
"121660500326833587347066330108700255257",
"197226415908754595787679376049925258294",
"175144240918627696706389043163020705352",
"20436973763401286396321817216566876575",
"330367912133000650234416714133209340575",
"89643941187703297761987712821495745751",
"179878819981819191237184392893219388408",
"339646452202614701305698831522823050617",
"159396926117267726652544130574558533213",
"144170050329981353372966156665661183281",
"262068676558711509831217486618013363205",
"68194612853305562036906942959198182537",
"147982133334808742802936746850746640097",
"188287710402255797747315035948801106767",
"284101723383781290022219617540114419816",
"293177386928530964471547645786252086508",
"15779983341982286451828558391328868055",
"39168555688690438076035169341504214971",
"107445837503732636214255104317215840241",
"310968217894393759923981334338335408596",
"169186351662557925778398158417814260479",
"129252227524841832480292152920369279699",
"44239815851079422320523672381900275345",
"223337884050438011219025392804223033222",
"169830670116710176435960193379510138940",
"124292021272379332837343334135053194440",
"218669114776656206751905706704368310351",
"57088269784231425612392639252025857389",
"126108984648702824450998775405599655909",
"255617379624037692455693671586636871365",
"292265071202787058271372941685282380925",
"53860944455546604474692588456365778634",
"113117854547287017753798240285429774943"
],
"threshold": 0.9
},
"id": "ASB-A-418776187-85d71857",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "115852418371893726666298693186447937427",
"length": 1201
},
"id": "ASB-A-418776187-1200fa83",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "getTextSearchQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"136802329616135471664233362941077006905",
"28691711636404942943129151565909700338",
"176295319073431672072655273712129123675",
"130890650755251801856216703833007809773",
"57656358259527680442444063474892333218",
"234444472540445350366806441521020852282",
"27672492891490450420418580039021852511",
"277699879074650758698282896124363268511",
"324430731079907372259348064736481606791",
"206636778078385431955076262011548960319",
"166294208799980148403719571268555688036",
"334714996978313036750087516054996875547",
"17009633391817132282331189091451115850",
"64043474417064679059821076242644881329",
"167904958192380504628677465047090773613",
"50851629648608132099150825168494814799",
"223388432775768910920057459329326454011",
"331591775732554817348856681836996512467",
"54401603461502414977538245383273933042",
"127440859949272792099447129142163832073",
"82508640193944607438434798999793587036",
"141118416137438315961463853621328794322",
"222426755692545485626279487218058586761",
"190423102012389054144931852614611045973",
"179878819981819191237184392893219388408",
"339646452202614701305698831522823050617",
"146200940727979671702208086640715949987",
"45976166416491864126854898888965939775",
"179404774849306018163078825074439384476",
"267592098320588670023594456550655836403",
"147982133334808742802936746850746640097",
"95216263369590486423596158446173485346",
"172690904525401890545773017015647306141",
"191618558072125599522074271844249386973",
"230741775141976062468833322014044448508",
"39168555688690438076035169341504214971",
"295694830112681881210904075318803043711",
"169525461909817483184047107653610640876",
"666454788699359580011857178232819547",
"109651799666511754100999079828735677537",
"4146283051387891575434168388216485067",
"223337884050438011219025392804223033222",
"169830670116710176435960193379510138940",
"124292021272379332837343334135053194440",
"218669114776656206751905706704368310351",
"57088269784231425612392639252025857389",
"126108984648702824450998775405599655909",
"248589592794879054592553943597856810635",
"63932034346910116701132762504166657525",
"67243975172799998017629671600115478660",
"321637405442106200371341651925005292639",
"214285540124007229306558810116208662907"
],
"threshold": 0.9
},
"id": "ASB-A-418776187-76cc1123",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "188880999255660073179596386710294385453",
"length": 8050
},
"id": "ASB-A-418776187-ac5bcc8a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "queryInternal"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"136802329616135471664233362941077006905",
"28691711636404942943129151565909700338",
"176295319073431672072655273712129123675",
"130890650755251801856216703833007809773",
"235475316097154250275043340527786554024",
"242782141094188487992674006370258409236",
"189149550968798635948326799958387587076",
"116262057794230151559796087261446461593",
"125325987970811906526294499378337441650",
"176950685375159166537452584878010797564",
"46954059598559379852697476943871151861",
"121660500326833587347066330108700255257",
"197226415908754595787679376049925258294",
"175144240918627696706389043163020705352",
"20436973763401286396321817216566876575",
"330367912133000650234416714133209340575",
"89643941187703297761987712821495745751",
"179878819981819191237184392893219388408",
"339646452202614701305698831522823050617",
"159396926117267726652544130574558533213",
"144170050329981353372966156665661183281",
"262068676558711509831217486618013363205",
"68194612853305562036906942959198182537",
"147982133334808742802936746850746640097",
"188287710402255797747315035948801106767",
"284101723383781290022219617540114419816",
"293177386928530964471547645786252086508",
"15779983341982286451828558391328868055",
"39168555688690438076035169341504214971",
"107445837503732636214255104317215840241",
"310968217894393759923981334338335408596",
"169186351662557925778398158417814260479",
"129252227524841832480292152920369279699",
"44239815851079422320523672381900275345",
"223337884050438011219025392804223033222",
"169830670116710176435960193379510138940",
"124292021272379332837343334135053194440",
"218669114776656206751905706704368310351",
"57088269784231425612392639252025857389",
"126108984648702824450998775405599655909",
"255617379624037692455693671586636871365",
"292265071202787058271372941685282380925",
"53860944455546604474692588456365778634",
"113117854547287017753798240285429774943"
],
"threshold": 0.9
},
"id": "ASB-A-418776187-44575b22",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "110241711838873038651601426381532248153",
"length": 907
},
"id": "ASB-A-418776187-4f7918d0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "getTextSearchQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "223011726168340967236817226657965545269",
"length": 6850
},
"id": "ASB-A-418776187-c1c797e5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669",
"target": {
"file": "src/com/android/providers/telephony/MmsSmsProvider.java",
"function": "query"
}
}
]
}