ASB-A-487147249

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-487147249.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-487147249
Aliases
  • A-487147249
  • CVE-2026-28599
Published
2026-09-01T00:00:00Z
Modified
2026-09-09T15:15:54Z
Summary
[none]
Details

In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/dc03f183688231c065ac0e13ef10a00732ba7199"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "154216155528703273005092877639218488988",
                    "324993677115389383557290111810716566376",
                    "161951373412032675668896320430866425004",
                    "84815149263490886434480395678664458264"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487147249-1f4584e5",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/dc03f183688231c065ac0e13ef10a00732ba7199",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "321204840111195526629169247703648001245",
                "length": 1309
            },
            "id": "ASB-A-487147249-9293603f",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/dc03f183688231c065ac0e13ef10a00732ba7199",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "addCreatorToken"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487147249.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/7c714bd3b2222d8d7331d609f08be65b9d67dbea"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "154216155528703273005092877639218488988",
                    "324993677115389383557290111810716566376",
                    "161951373412032675668896320430866425004",
                    "84815149263490886434480395678664458264"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487147249-3220adba",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7c714bd3b2222d8d7331d609f08be65b9d67dbea",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "34177301796551893962902788463562082780",
                "length": 1768
            },
            "id": "ASB-A-487147249-980506c3",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7c714bd3b2222d8d7331d609f08be65b9d67dbea",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "addCreatorToken"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487147249.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/8aa520888483a29cedb09023b88f5e29dee966fb"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "154216155528703273005092877639218488988",
                    "324993677115389383557290111810716566376",
                    "161951373412032675668896320430866425004",
                    "84815149263490886434480395678664458264"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487147249-81c7299e",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/8aa520888483a29cedb09023b88f5e29dee966fb",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "34177301796551893962902788463562082780",
                "length": 1768
            },
            "id": "ASB-A-487147249-bfd5acfe",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/8aa520888483a29cedb09023b88f5e29dee966fb",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "addCreatorToken"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487147249.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/acbde95f3eec1695d5bf4fa52e4153ef1d1a708a"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "154216155528703273005092877639218488988",
                    "324993677115389383557290111810716566376",
                    "161951373412032675668896320430866425004",
                    "84815149263490886434480395678664458264"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487147249-e8caecbd",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/acbde95f3eec1695d5bf4fa52e4153ef1d1a708a",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "321204840111195526629169247703648001245",
                "length": 1309
            },
            "id": "ASB-A-487147249-f35584d2",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/acbde95f3eec1695d5bf4fa52e4153ef1d1a708a",
            "target": {
                "file": "services/core/java/com/android/server/am/ActivityManagerService.java",
                "function": "addCreatorToken"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487147249.json"