In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/c6e940d710fbd4383f2e999f4d1a2234c0ae11dc"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"314491743165801948123262950922210516532",
"281711988256244874554787287552216749399",
"83841026515189704200015352038518875857",
"134548027252990306907230439262372317069",
"242557198168100842837376928432032907867",
"212198471106597362628783621170278581071",
"116741174541360479486316790328088464386",
"273368188948173911464489148214274841410",
"165752730715071622491233163929213851290"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-1aea3df8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/c6e940d710fbd4383f2e999f4d1a2234c0ae11dc",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "141782428824802642949931918294330175748",
"length": 608
},
"id": "ASB-A-459460951-be735a98",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/c6e940d710fbd4383f2e999f4d1a2234c0ae11dc",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java",
"function": "checkSubscriptionAssociatedWithUser"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "49785933579441875669908815356361611936",
"length": 719
},
"id": "ASB-A-459460951-0b86aebe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredText"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "234495463127686722443156479948848580485",
"length": 747
},
"id": "ASB-A-459460951-98900e6c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredMultipartText"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"98043236030772146082793337236296238717",
"108438292240198667044992932427419031023",
"12005593342205208870274374818040482355",
"325710822266304529067751621639196001352"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-d2c6637d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961",
"target": {
"file": "src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"90228688156430979903343446701831398516",
"264631826315680333814687486510804304030",
"87613765760672379253449611814982469956",
"317017134271730343835728322008917066771",
"272125616025489698398826578524128504483",
"110248927711739923489248316846811819917",
"18635445160070284091469821276910560372",
"143951072537177597762714706957505342215",
"111772090368289363102083054791839693323",
"18130604361217788038250834497169969686",
"36774268761721323831576035399644438143",
"243448042227188207368857343813622762477",
"205711528463042389763454601506716539833"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-d4015021",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/6cffd2ed55767990357cf11ab54718954ac6d961",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/317601a2835578dd049383101ce380f27e34ef41"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "141782428824802642949931918294330175748",
"length": 608
},
"id": "ASB-A-459460951-29c7ba68",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/317601a2835578dd049383101ce380f27e34ef41",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java",
"function": "checkSubscriptionAssociatedWithUser"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"314491743165801948123262950922210516532",
"281711988256244874554787287552216749399",
"83841026515189704200015352038518875857",
"134548027252990306907230439262372317069",
"242557198168100842837376928432032907867",
"212198471106597362628783621170278581071",
"116741174541360479486316790328088464386",
"273368188948173911464489148214274841410",
"165752730715071622491233163929213851290"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-8b856d65",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/317601a2835578dd049383101ce380f27e34ef41",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "237115520426249656102696369553982150623",
"length": 632
},
"id": "ASB-A-459460951-124e3c26",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredText"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"74775786963757892677466474442989367079",
"73502138666139269991024399683830686201",
"279994131248835305918298891509137584136",
"317017134271730343835728322008917066771",
"86797430969411904796541856642897395742",
"198739071019880017494062073610405901429",
"96002864560410248236344145552632222126",
"39330019612956078569066622781821208727",
"260849834579265409309202059693066502580",
"207227479982182757967255081291369175668",
"36774268761721323831576035399644438143",
"243448042227188207368857343813622762477",
"205711528463042389763454601506716539833"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-2bca0fb2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"98043236030772146082793337236296238717",
"108438292240198667044992932427419031023",
"12005593342205208870274374818040482355",
"325710822266304529067751621639196001352"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-38e0e34c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af",
"target": {
"file": "src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "209485642538337701783658441792947791822",
"length": 660
},
"id": "ASB-A-459460951-98d42f1c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/f03821d51b64e0eac6870f8565694143dadad2af",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredMultipartText"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/1aae4267206d1a08d30158bfce99a766550f1afd"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"314491743165801948123262950922210516532",
"281711988256244874554787287552216749399",
"83841026515189704200015352038518875857",
"134548027252990306907230439262372317069",
"242557198168100842837376928432032907867",
"212198471106597362628783621170278581071",
"116741174541360479486316790328088464386",
"273368188948173911464489148214274841410",
"165752730715071622491233163929213851290"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-231b0f38",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/1aae4267206d1a08d30158bfce99a766550f1afd",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "141782428824802642949931918294330175748",
"length": 608
},
"id": "ASB-A-459460951-9c092e05",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/1aae4267206d1a08d30158bfce99a766550f1afd",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java",
"function": "checkSubscriptionAssociatedWithUser"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"74775786963757892677466474442989367079",
"73502138666139269991024399683830686201",
"279994131248835305918298891509137584136",
"317017134271730343835728322008917066771",
"297712991158285410917672672985501731946",
"27453540411357979666228332925531163072",
"101930701347659089037017261600480075804",
"215121875714410693865399204354840310654",
"26898975272359097872418799516659272247",
"45630850879745698146895133740609720992",
"86797430969411904796541856642897395742",
"110248927711739923489248316846811819917",
"189261087086982396803033661412760932935",
"307270290257897599719812123790660509009",
"116390827937237596379501881976627447295",
"270008887797449153419812292017403152621",
"27140489876626401156469873938072959187",
"79494701042987115461538829588879337501",
"39330019612956078569066622781821208727",
"111772090368289363102083054791839693323",
"88205013806212371733316656435845009925",
"36774268761721323831576035399644438143",
"243448042227188207368857343813622762477",
"205711528463042389763454601506716539833"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-45c819e7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"98043236030772146082793337236296238717",
"108438292240198667044992932427419031023",
"12005593342205208870274374818040482355",
"325710822266304529067751621639196001352"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-4d8fd2c5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb",
"target": {
"file": "src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "150513958370728880399310669791159728820",
"length": 717
},
"id": "ASB-A-459460951-bae7367e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredMultipartText"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "209947485150884182026183962848039118935",
"length": 689
},
"id": "ASB-A-459460951-cc24438e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/92143d3e5ee352208511dff16728c16b0ec299bb",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredText"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/3913c258e5da85b42cd60db49f5226c10eebcce2"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"314491743165801948123262950922210516532",
"281711988256244874554787287552216749399",
"83841026515189704200015352038518875857",
"134548027252990306907230439262372317069",
"242557198168100842837376928432032907867",
"212198471106597362628783621170278581071",
"116741174541360479486316790328088464386",
"273368188948173911464489148214274841410",
"165752730715071622491233163929213851290"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-66f6b188",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/3913c258e5da85b42cd60db49f5226c10eebcce2",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "141782428824802642949931918294330175748",
"length": 608
},
"id": "ASB-A-459460951-82edb078",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/3913c258e5da85b42cd60db49f5226c10eebcce2",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java",
"function": "checkSubscriptionAssociatedWithUser"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"74775786963757892677466474442989367079",
"73502138666139269991024399683830686201",
"279994131248835305918298891509137584136",
"317017134271730343835728322008917066771",
"272125616025489698398826578524128504483",
"110248927711739923489248316846811819917",
"18635445160070284091469821276910560372",
"143951072537177597762714706957505342215",
"111772090368289363102083054791839693323",
"18130604361217788038250834497169969686",
"36774268761721323831576035399644438143",
"243448042227188207368857343813622762477",
"205711528463042389763454601506716539833"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-3714dbd2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "234495463127686722443156479948848580485",
"length": 747
},
"id": "ASB-A-459460951-603a3716",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredMultipartText"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "49785933579441875669908815356361611936",
"length": 719
},
"id": "ASB-A-459460951-aa948206",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredText"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"98043236030772146082793337236296238717",
"108438292240198667044992932427419031023",
"12005593342205208870274374818040482355",
"325710822266304529067751621639196001352"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-fad03072",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/cbecd57d7992d6d8ad40ddee7cc8a45bac88b35d",
"target": {
"file": "src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/4b47face486ac4955bbba6b9333a5ce2266572aa"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"314491743165801948123262950922210516532",
"252598080043004827681757014611365046554",
"217625807822754269569859293540316366295",
"159776500266863526666748962523335670120",
"301540864122162222560784990278895136549",
"116741174541360479486316790328088464386",
"273368188948173911464489148214274841410",
"165752730715071622491233163929213851290"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-978aa743",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/4b47face486ac4955bbba6b9333a5ce2266572aa",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "118426378044520048888982666814326048856",
"length": 586
},
"id": "ASB-A-459460951-9c469f7b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/4b47face486ac4955bbba6b9333a5ce2266572aa",
"target": {
"file": "telephony/common/com/android/internal/telephony/TelephonyPermissions.java",
"function": "checkSubscriptionAssociatedWithUser"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "237115520426249656102696369553982150623",
"length": 632
},
"id": "ASB-A-459460951-25a688a4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredText"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "209485642538337701783658441792947791822",
"length": 660
},
"id": "ASB-A-459460951-47b79a01",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java",
"function": "sendStoredMultipartText"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"90228688156430979903343446701831398516",
"264631826315680333814687486510804304030",
"87613765760672379253449611814982469956",
"317017134271730343835728322008917066771",
"127738613636760661849125486534341292321",
"46497981190808472824079839750577843401",
"231017406722351973647466605896912637162",
"87802942734101893942532258000664230763",
"86797430969411904796541856642897395742",
"198739071019880017494062073610405901429",
"96002864560410248236344145552632222126",
"39330019612956078569066622781821208727",
"260849834579265409309202059693066502580",
"207227479982182757967255081291369175668",
"36774268761721323831576035399644438143",
"243448042227188207368857343813622762477",
"11326197185867692115674269153010869525"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-87c12ffe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634",
"target": {
"file": "src/java/com/android/internal/telephony/SmsController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"98043236030772146082793337236296238717",
"108438292240198667044992932427419031023",
"12005593342205208870274374818040482355",
"325710822266304529067751621639196001352"
],
"threshold": 0.9
},
"id": "ASB-A-459460951-be6ca932",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/opt/telephony/+/534b628339a3e392dd9e3c7492d9f95bdef0f634",
"target": {
"file": "src/java/com/android/internal/telephony/IccSmsInterfaceManager.java"
}
}
]
}