ASB-A-461500706

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-461500706.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-461500706
Aliases
  • A-461500706
  • CVE-2026-28631
Published
2026-09-01T00:00:00Z
Modified
2026-09-08T15:39:03Z
Summary
[none]
Details

In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/426df92120398800fc185c7540f6263a58cbea2d",
        "https://android.googlesource.com/platform/frameworks/base/+/7722192034b5aa341b46cf7803bad3050cf6a054"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "78139153521333413375691220346111554848",
                    "22117557816079280115461150826927296930",
                    "22236105038616136280216033962554511711",
                    "331192511457113304253531561818596609096"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-0496c580",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/426df92120398800fc185c7540f6263a58cbea2d",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "275600975068241849699869813208466523774",
                "length": 1710
            },
            "id": "ASB-A-461500706-0f22c187",
            "match_only_versions": [
                "17-next"
            ],
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7722192034b5aa341b46cf7803bad3050cf6a054",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "onCreate"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "151257780129023544978963930218942193362",
                    "114736881790020246893202071589709360605",
                    "113727632206974886353707745357651912544",
                    "215030698924241381202671228134672837834",
                    "335097099142340031416459041471911055346",
                    "136567066977832655758858044248128329832",
                    "247047352691011741949288614955118646481",
                    "282610005211683422463218026581057951122",
                    "290239436913716466994902491240806381237",
                    "177209998832725559019748183461050806389",
                    "7147032207968402908323949559221056306",
                    "56419335929094113911132560272243684991",
                    "129683992516956698035414025774403438917",
                    "120609988045666988121400073853647420946",
                    "325850132597459714713299309192660703042",
                    "140087489249634326301456327272266307535"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-3e9ef8e0",
            "match_only_versions": [
                "17-next"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7722192034b5aa341b46cf7803bad3050cf6a054",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "70802502375059167023747500290520995705",
                "length": 850
            },
            "id": "ASB-A-461500706-6cd8b2a0",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/426df92120398800fc185c7540f6263a58cbea2d",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "buildMiniResolver"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/61d262e6eecffba83604886470a28e636b3fac5a",
        "https://android.googlesource.com/platform/frameworks/base/+/05df4e24983caaf46c9d35d82d5eaa7b7557fbab"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "151257780129023544978963930218942193362",
                    "114736881790020246893202071589709360605",
                    "113727632206974886353707745357651912544",
                    "215030698924241381202671228134672837834",
                    "335097099142340031416459041471911055346",
                    "136567066977832655758858044248128329832",
                    "247047352691011741949288614955118646481",
                    "282610005211683422463218026581057951122",
                    "290239436913716466994902491240806381237",
                    "177209998832725559019748183461050806389",
                    "7147032207968402908323949559221056306",
                    "56419335929094113911132560272243684991",
                    "129683992516956698035414025774403438917",
                    "120609988045666988121400073853647420946",
                    "325850132597459714713299309192660703042",
                    "140087489249634326301456327272266307535"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-7953c9ef",
            "match_only_versions": [
                "15"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/05df4e24983caaf46c9d35d82d5eaa7b7557fbab",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "78139153521333413375691220346111554848",
                    "22117557816079280115461150826927296930",
                    "22236105038616136280216033962554511711",
                    "331192511457113304253531561818596609096"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-7cef289c",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/61d262e6eecffba83604886470a28e636b3fac5a",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "174458064475516220585128677805942495439",
                "length": 910
            },
            "id": "ASB-A-461500706-a04db347",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/61d262e6eecffba83604886470a28e636b3fac5a",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "buildMiniResolver"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "275600975068241849699869813208466523774",
                "length": 1710
            },
            "id": "ASB-A-461500706-ef700c8a",
            "match_only_versions": [
                "15"
            ],
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/05df4e24983caaf46c9d35d82d5eaa7b7557fbab",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "onCreate"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/da0e8bcdd7faefd6a20db1084f4548f879ff709b",
        "https://android.googlesource.com/platform/frameworks/base/+/a9afcde1ea0991c9e3a64a29a895112af4012d02"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "70802502375059167023747500290520995705",
                "length": 850
            },
            "id": "ASB-A-461500706-58ffae21",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/da0e8bcdd7faefd6a20db1084f4548f879ff709b",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "buildMiniResolver"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "78139153521333413375691220346111554848",
                    "22117557816079280115461150826927296930",
                    "22236105038616136280216033962554511711",
                    "331192511457113304253531561818596609096"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-8bb494b4",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/da0e8bcdd7faefd6a20db1084f4548f879ff709b",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "151257780129023544978963930218942193362",
                    "114736881790020246893202071589709360605",
                    "113727632206974886353707745357651912544",
                    "215030698924241381202671228134672837834",
                    "335097099142340031416459041471911055346",
                    "136567066977832655758858044248128329832",
                    "247047352691011741949288614955118646481",
                    "282610005211683422463218026581057951122",
                    "290239436913716466994902491240806381237",
                    "177209998832725559019748183461050806389",
                    "7147032207968402908323949559221056306",
                    "56419335929094113911132560272243684991",
                    "129683992516956698035414025774403438917",
                    "120609988045666988121400073853647420946",
                    "325850132597459714713299309192660703042",
                    "140087489249634326301456327272266307535"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-c1946e8c",
            "match_only_versions": [
                "16"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a9afcde1ea0991c9e3a64a29a895112af4012d02",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "275600975068241849699869813208466523774",
                "length": 1710
            },
            "id": "ASB-A-461500706-ef05c292",
            "match_only_versions": [
                "16"
            ],
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/a9afcde1ea0991c9e3a64a29a895112af4012d02",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "onCreate"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/c2a300b19cec96eb1f9d7104a024074638a1489d"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "70802502375059167023747500290520995705",
                "length": 850
            },
            "id": "ASB-A-461500706-343519a7",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c2a300b19cec96eb1f9d7104a024074638a1489d",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "buildMiniResolver"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "78139153521333413375691220346111554848",
                    "22117557816079280115461150826927296930",
                    "22236105038616136280216033962554511711",
                    "331192511457113304253531561818596609096"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-9423b083",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c2a300b19cec96eb1f9d7104a024074638a1489d",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/6354e06830d76c34a05963ac0e3dade4d4bc9969"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "151257780129023544978963930218942193362",
                    "114736881790020246893202071589709360605",
                    "113727632206974886353707745357651912544",
                    "215030698924241381202671228134672837834",
                    "335097099142340031416459041471911055346",
                    "136567066977832655758858044248128329832",
                    "247047352691011741949288614955118646481",
                    "282610005211683422463218026581057951122",
                    "290239436913716466994902491240806381237",
                    "177209998832725559019748183461050806389",
                    "7147032207968402908323949559221056306",
                    "56419335929094113911132560272243684991",
                    "129683992516956698035414025774403438917",
                    "120609988045666988121400073853647420946",
                    "325850132597459714713299309192660703042",
                    "140087489249634326301456327272266307535"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-24d3b0b4",
            "match_only_versions": [
                "17"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/6354e06830d76c34a05963ac0e3dade4d4bc9969",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "275600975068241849699869813208466523774",
                "length": 1710
            },
            "id": "ASB-A-461500706-56d0842b",
            "match_only_versions": [
                "17"
            ],
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/6354e06830d76c34a05963ac0e3dade4d4bc9969",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "onCreate"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/e838f07168599d15409739b25c8f1f21ffdfd219",
        "https://android.googlesource.com/platform/frameworks/base/+/b30b08cda230cd13bd343bd35857e9c1cd56f0cc"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "151257780129023544978963930218942193362",
                    "114736881790020246893202071589709360605",
                    "113727632206974886353707745357651912544",
                    "215030698924241381202671228134672837834",
                    "335097099142340031416459041471911055346",
                    "136567066977832655758858044248128329832",
                    "247047352691011741949288614955118646481",
                    "282610005211683422463218026581057951122",
                    "290239436913716466994902491240806381237",
                    "177209998832725559019748183461050806389",
                    "7147032207968402908323949559221056306",
                    "56419335929094113911132560272243684991",
                    "129683992516956698035414025774403438917",
                    "120609988045666988121400073853647420946",
                    "325850132597459714713299309192660703042",
                    "140087489249634326301456327272266307535"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-1dd5c6e6",
            "match_only_versions": [
                "14"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/b30b08cda230cd13bd343bd35857e9c1cd56f0cc",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "184516046974447784803309019411650566097",
                "length": 2530
            },
            "id": "ASB-A-461500706-bfbea1f9",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e838f07168599d15409739b25c8f1f21ffdfd219",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "maybeShowUserConsentMiniResolver"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "207289286970300325222978528348440114263",
                    "43274313884391543354050929222644838433",
                    "41738662658140835377580167144017564658",
                    "131105229186852075314974234120574923066"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-461500706-c868b5bf",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e838f07168599d15409739b25c8f1f21ffdfd219",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "153839060791627352531712220202893375938",
                "length": 2097
            },
            "id": "ASB-A-461500706-e94d97e1",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/b30b08cda230cd13bd343bd35857e9c1cd56f0cc",
            "target": {
                "file": "core/java/com/android/internal/app/IntentForwarderActivity.java",
                "function": "onCreate"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"