ASB-A-475542441

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-475542441.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-475542441
Aliases
  • A-475542441
  • CVE-2026-28612
Published
2026-09-01T00:00:00Z
Modified
2026-09-08T15:39:03Z
Summary
[none]
Details

In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "80397874819914435962287995189429353279",
                    "324869342438177983429542822815814803635",
                    "33402783348378538749849599688089551584",
                    "198819044329240885950294912553429500532",
                    "77085443262448550127383596857662322331",
                    "212192366188771760189339415757557208188",
                    "53865122812802975109679423727452725434",
                    "125981947974766921488540001279500083414",
                    "201770805904630782353555982116669700691",
                    "264599426912119222982544240821614659420",
                    "189141642157816828296152565283176316292",
                    "124537554651593874843128017938572052325",
                    "7450090752167862960006447653757967239",
                    "34927843616474237649522512679983462444",
                    "57700655952896568908631876239598985640",
                    "198015338095479692361873197064248404950"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-475542441-4ca3caab",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "152318689115643783965315851415430113549",
                "length": 3806
            },
            "id": "ASB-A-475542441-6bb1ab40",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function": "resolveActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "38071842428035955743637239282560935679",
                "length": 4720
            },
            "id": "ASB-A-475542441-75556df6",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java",
                "function": "startActivities"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "325917412571960559806126044957144615378",
                    "253302707306192844154826311543182663588",
                    "86405427633677763232192497837533324472",
                    "189699288453370789495197806146032801016",
                    "297518760508301895902510879832999055580",
                    "337597234209694277940537694039608318580",
                    "329389155866721868791704832052920768272",
                    "282863183023824702358406795703522283096",
                    "130130167180154615443060466846737541997",
                    "211792142800539105703932329430569283144",
                    "178266103278669671856588323618706586269",
                    "295539928809912818928136327791533605105",
                    "78582916131776485440030767200248866074",
                    "189197256195804816283729717437234652939",
                    "149268927962259120998306307305489256989",
                    "113325408472494198665526707802296386374",
                    "148164836224747363588314045789274849445",
                    "324230526512426163353082979198179157586",
                    "167372610395889717606324395043224027605",
                    "37946721957814839870797236343900513553"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-475542441-fc8d6842",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-475542441.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "186982109334638526793663879095329947989",
                "length": 3849
            },
            "id": "ASB-A-475542441-1d14a9cc",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function": "resolveActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "325917412571960559806126044957144615378",
                    "253302707306192844154826311543182663588",
                    "86405427633677763232192497837533324472",
                    "189699288453370789495197806146032801016",
                    "297518760508301895902510879832999055580",
                    "337597234209694277940537694039608318580",
                    "329389155866721868791704832052920768272",
                    "282863183023824702358406795703522283096",
                    "130130167180154615443060466846737541997",
                    "211792142800539105703932329430569283144",
                    "178266103278669671856588323618706586269",
                    "295539928809912818928136327791533605105",
                    "78582916131776485440030767200248866074",
                    "189197256195804816283729717437234652939",
                    "149268927962259120998306307305489256989",
                    "113325408472494198665526707802296386374",
                    "148164836224747363588314045789274849445",
                    "324230526512426163353082979198179157586",
                    "167372610395889717606324395043224027605",
                    "37946721957814839870797236343900513553"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-475542441-47d54763",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "80397874819914435962287995189429353279",
                    "324869342438177983429542822815814803635",
                    "33402783348378538749849599688089551584",
                    "198819044329240885950294912553429500532",
                    "77085443262448550127383596857662322331",
                    "212192366188771760189339415757557208188",
                    "53865122812802975109679423727452725434",
                    "125981947974766921488540001279500083414",
                    "201770805904630782353555982116669700691",
                    "264599426912119222982544240821614659420",
                    "189141642157816828296152565283176316292",
                    "124537554651593874843128017938572052325",
                    "7450090752167862960006447653757967239",
                    "34927843616474237649522512679983462444",
                    "57700655952896568908631876239598985640",
                    "198015338095479692361873197064248404950"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-475542441-e10a4a25",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "50496487256533071234918033827480579586",
                "length": 4747
            },
            "id": "ASB-A-475542441-f2b3c28a",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java",
                "function": "startActivities"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-475542441.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "186982109334638526793663879095329947989",
                "length": 3849
            },
            "id": "ASB-A-475542441-52dce7e0",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function": "resolveActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "80397874819914435962287995189429353279",
                    "324869342438177983429542822815814803635",
                    "33402783348378538749849599688089551584",
                    "198819044329240885950294912553429500532",
                    "77085443262448550127383596857662322331",
                    "212192366188771760189339415757557208188",
                    "53865122812802975109679423727452725434",
                    "125981947974766921488540001279500083414",
                    "201770805904630782353555982116669700691",
                    "264599426912119222982544240821614659420",
                    "189141642157816828296152565283176316292",
                    "124537554651593874843128017938572052325",
                    "7450090752167862960006447653757967239",
                    "34927843616474237649522512679983462444",
                    "57700655952896568908631876239598985640",
                    "198015338095479692361873197064248404950"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-475542441-a4a0ead6",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "325917412571960559806126044957144615378",
                    "253302707306192844154826311543182663588",
                    "86405427633677763232192497837533324472",
                    "189699288453370789495197806146032801016",
                    "297518760508301895902510879832999055580",
                    "337597234209694277940537694039608318580",
                    "329389155866721868791704832052920768272",
                    "282863183023824702358406795703522283096",
                    "130130167180154615443060466846737541997",
                    "211792142800539105703932329430569283144",
                    "178266103278669671856588323618706586269",
                    "295539928809912818928136327791533605105",
                    "78582916131776485440030767200248866074",
                    "189197256195804816283729717437234652939",
                    "149268927962259120998306307305489256989",
                    "113325408472494198665526707802296386374",
                    "148164836224747363588314045789274849445",
                    "324230526512426163353082979198179157586",
                    "167372610395889717606324395043224027605",
                    "37946721957814839870797236343900513553"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-475542441-b1d48f17",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "50496487256533071234918033827480579586",
                "length": 4747
            },
            "id": "ASB-A-475542441-f6a0a54d",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java",
                "function": "startActivities"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-475542441.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "38071842428035955743637239282560935679",
                "length": 4720
            },
            "id": "ASB-A-475542441-6865d39f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java",
                "function": "startActivities"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "152318689115643783965315851415430113549",
                "length": 3806
            },
            "id": "ASB-A-475542441-70cd8251",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function": "resolveActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "325917412571960559806126044957144615378",
                    "253302707306192844154826311543182663588",
                    "86405427633677763232192497837533324472",
                    "189699288453370789495197806146032801016",
                    "297518760508301895902510879832999055580",
                    "337597234209694277940537694039608318580",
                    "329389155866721868791704832052920768272",
                    "282863183023824702358406795703522283096",
                    "130130167180154615443060466846737541997",
                    "211792142800539105703932329430569283144",
                    "178266103278669671856588323618706586269",
                    "295539928809912818928136327791533605105",
                    "78582916131776485440030767200248866074",
                    "189197256195804816283729717437234652939",
                    "149268927962259120998306307305489256989",
                    "113325408472494198665526707802296386374",
                    "148164836224747363588314045789274849445",
                    "324230526512426163353082979198179157586",
                    "167372610395889717606324395043224027605",
                    "37946721957814839870797236343900513553"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-475542441-cab10468",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "80397874819914435962287995189429353279",
                    "324869342438177983429542822815814803635",
                    "33402783348378538749849599688089551584",
                    "198819044329240885950294912553429500532",
                    "77085443262448550127383596857662322331",
                    "212192366188771760189339415757557208188",
                    "53865122812802975109679423727452725434",
                    "125981947974766921488540001279500083414",
                    "201770805904630782353555982116669700691",
                    "264599426912119222982544240821614659420",
                    "189141642157816828296152565283176316292",
                    "124537554651593874843128017938572052325",
                    "7450090752167862960006447653757967239",
                    "34927843616474237649522512679983462444",
                    "57700655952896568908631876239598985640",
                    "198015338095479692361873197064248404950"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-475542441-ce023634",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-475542441.json"