ASB-A-477024345

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-477024345.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-477024345

Aliases

A-477024345
CVE-2026-28620

Published

2026-09-01T00:00:00Z

Modified

2026-09-08T15:39:03Z

Summary

[none]

Details

In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2026-09-01

Affected packages

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17-next:0

Fixed

17-next:2026-09-01

Affected versions

Other

17-next

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "152318689115643783965315851415430113549",
                "length": 3806
            },
            "id": "ASB-A-477024345-32655172",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function": "resolveActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "311931675790667359574614959848407815702",
                    "163252509079289346664598790677778443218",
                    "81385348547056583696103598749518187225",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "37670851724393402769987267860672672230"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-3ed1f3e9",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "35569745026013085848239426614272421549",
                    "173256776503252644784681834994761176508",
                    "194188360801631649423941407410132786513",
                    "248475251836087992390790924110843801200",
                    "112910424240242112564828443782631983980",
                    "44472087015759157047368738032372413949",
                    "118605152507255773949623267589271039415",
                    "186329621376257576555161691475201072784",
                    "64411954336128645573010321346078750655",
                    "147890503543006373049841438025174675528",
                    "270873643634567871409597883676451149861",
                    "335972251913161175978062125401849251240",
                    "26222936968821393451451797395371633530",
                    "103776494053485082044950756777474764424",
                    "293765116076340145545323415283053483909",
                    "328829695709924917487563941793712321161"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-4622895e",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0",
            "target": {
                "file": "services/core/java/com/android/server/uri/NeededUriGrants.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "38071842428035955743637239282560935679",
                "length": 4720
            },
            "id": "ASB-A-477024345-5bf69e4b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java",
                "function": "startActivities"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "89348211610579307423791110472317762373",
                "length": 542
            },
            "id": "ASB-A-477024345-a5fe7318",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0",
            "target": {
                "file": "services/core/java/com/android/server/uri/NeededUriGrants.java",
                "function": "merge"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "125269627930518898555081884368879613133",
                    "178224263307165794426840339082286572912",
                    "313681859873681975699662879793020049486",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "129048391759178933727709666415787659955",
                    "51404594350926397848415728400378119354",
                    "56951790898355548827536525945965240160",
                    "47308593454506064418212278157537728877",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "129048391759178933727709666415787659955"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-fa805f75",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-477024345.json"

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16:0

Fixed

16:2026-09-01

Affected versions

Other

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "283223847655597982080293287674541690965",
                "length": 3849
            },
            "id": "ASB-A-477024345-14c31a31",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function": "resolveActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "5778001945956117264740357899042616041",
                "length": 5109
            },
            "id": "ASB-A-477024345-1e52693b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java",
                "function": "startActivities"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "204079113822947347771730577170556123068",
                    "172530096293394197421915780989262411",
                    "195951391941049641906592842730310883678",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "37670851724393402769987267860672672230"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-2dd99732",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "35569745026013085848239426614272421549",
                    "173256776503252644784681834994761176508",
                    "194188360801631649423941407410132786513",
                    "248475251836087992390790924110843801200",
                    "112910424240242112564828443782631983980",
                    "44472087015759157047368738032372413949",
                    "118605152507255773949623267589271039415",
                    "186329621376257576555161691475201072784",
                    "64411954336128645573010321346078750655",
                    "147890503543006373049841438025174675528",
                    "270873643634567871409597883676451149861",
                    "335972251913161175978062125401849251240",
                    "26222936968821393451451797395371633530",
                    "103776494053485082044950756777474764424",
                    "293765116076340145545323415283053483909",
                    "328829695709924917487563941793712321161"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-30a2c6f0",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09",
            "target": {
                "file": "services/core/java/com/android/server/uri/NeededUriGrants.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "89348211610579307423791110472317762373",
                "length": 542
            },
            "id": "ASB-A-477024345-5151c8f8",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09",
            "target": {
                "file": "services/core/java/com/android/server/uri/NeededUriGrants.java",
                "function": "merge"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "338725473824679195199727831045888689853",
                    "178224263307165794426840339082286572912",
                    "313681859873681975699662879793020049486",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "129048391759178933727709666415787659955",
                    "12154416197711547475059348709956217156",
                    "218629848199710159601992890428026474254",
                    "44625833088130840786537487043808975684",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "129048391759178933727709666415787659955"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-860651a3",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-477024345.json"

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16-qpr2:0

Fixed

16-qpr2:2026-09-01

Affected versions

Other

16-qpr2

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "283223847655597982080293287674541690965",
                "length": 3849
            },
            "id": "ASB-A-477024345-18621891",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function": "resolveActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "89348211610579307423791110472317762373",
                "length": 542
            },
            "id": "ASB-A-477024345-6f04c271",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f",
            "target": {
                "file": "services/core/java/com/android/server/uri/NeededUriGrants.java",
                "function": "merge"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "35569745026013085848239426614272421549",
                    "173256776503252644784681834994761176508",
                    "194188360801631649423941407410132786513",
                    "248475251836087992390790924110843801200",
                    "112910424240242112564828443782631983980",
                    "44472087015759157047368738032372413949",
                    "118605152507255773949623267589271039415",
                    "186329621376257576555161691475201072784",
                    "64411954336128645573010321346078750655",
                    "147890503543006373049841438025174675528",
                    "270873643634567871409597883676451149861",
                    "335972251913161175978062125401849251240",
                    "26222936968821393451451797395371633530",
                    "103776494053485082044950756777474764424",
                    "293765116076340145545323415283053483909",
                    "328829695709924917487563941793712321161"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-7017f3d5",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f",
            "target": {
                "file": "services/core/java/com/android/server/uri/NeededUriGrants.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "5778001945956117264740357899042616041",
                "length": 5109
            },
            "id": "ASB-A-477024345-793be8d3",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java",
                "function": "startActivities"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "204079113822947347771730577170556123068",
                    "172530096293394197421915780989262411",
                    "195951391941049641906592842730310883678",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "37670851724393402769987267860672672230"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-cba76085",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "338725473824679195199727831045888689853",
                    "178224263307165794426840339082286572912",
                    "313681859873681975699662879793020049486",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "129048391759178933727709666415787659955",
                    "12154416197711547475059348709956217156",
                    "218629848199710159601992890428026474254",
                    "44625833088130840786537487043808975684",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "129048391759178933727709666415787659955"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-cd089d41",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-477024345.json"

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17:0

Fixed

17:2026-09-01

Affected versions

Other

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "35569745026013085848239426614272421549",
                    "173256776503252644784681834994761176508",
                    "194188360801631649423941407410132786513",
                    "248475251836087992390790924110843801200",
                    "112910424240242112564828443782631983980",
                    "44472087015759157047368738032372413949",
                    "118605152507255773949623267589271039415",
                    "186329621376257576555161691475201072784",
                    "64411954336128645573010321346078750655",
                    "147890503543006373049841438025174675528",
                    "270873643634567871409597883676451149861",
                    "335972251913161175978062125401849251240",
                    "26222936968821393451451797395371633530",
                    "103776494053485082044950756777474764424",
                    "293765116076340145545323415283053483909",
                    "328829695709924917487563941793712321161"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-030acc9d",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c",
            "target": {
                "file": "services/core/java/com/android/server/uri/NeededUriGrants.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "89348211610579307423791110472317762373",
                "length": 542
            },
            "id": "ASB-A-477024345-3e8c103c",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c",
            "target": {
                "file": "services/core/java/com/android/server/uri/NeededUriGrants.java",
                "function": "merge"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "125269627930518898555081884368879613133",
                    "178224263307165794426840339082286572912",
                    "313681859873681975699662879793020049486",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "129048391759178933727709666415787659955",
                    "51404594350926397848415728400378119354",
                    "56951790898355548827536525945965240160",
                    "47308593454506064418212278157537728877",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "129048391759178933727709666415787659955"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-509c4d4a",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "38071842428035955743637239282560935679",
                "length": 4720
            },
            "id": "ASB-A-477024345-70f6eb42",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java",
                "function": "startActivities"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "311931675790667359574614959848407815702",
                    "163252509079289346664598790677778443218",
                    "81385348547056583696103598749518187225",
                    "153284084378809162492688464036135396280",
                    "217949069136231241119266033625709029021",
                    "276242586268243559182812891332093382542",
                    "37670851724393402769987267860672672230"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-477024345-b80faff8",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStartController.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "152318689115643783965315851415430113549",
                "length": 3806
            },
            "id": "ASB-A-477024345-c2ad4e6f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c",
            "target": {
                "file": "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function": "resolveActivity"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-477024345.json"