ASB-A-487522353

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-487522353.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-487522353
Aliases
  • A-487522353
  • CVE-2026-28582
Published
2026-09-01T00:00:00Z
Modified
2026-09-08T15:39:03Z
Summary
[none]
Details

In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "225355106264462343682862456478620329099",
                "length": 5863
            },
            "id": "ASB-A-487522353-0c9800eb",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java",
                "function": "onCreate"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "9652668052313215211809457435577099329",
                    "42302541755554764317914228322417196827",
                    "182510943443562764666308444493969446172",
                    "268510628125414722993030442318504867595",
                    "102830875642936636489652925739976357282",
                    "122815770119339302529597811558588685136",
                    "231546043599135225282422895037581395220"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-6d97024b",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "50448111178302970871280963852843707910",
                    "73631506534017129656694136800952130062",
                    "272470036045758090437155815418827724949",
                    "159824744492675985466948094975854045731"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-b1b85ee4",
            "match_only_versions": [
                "17-next"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead",
            "target": {
                "file": "tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "50448111178302970871280963852843707910",
                    "73631506534017129656694136800952130062",
                    "272470036045758090437155815418827724949",
                    "159824744492675985466948094975854045731"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-8bd60f9d",
            "match_only_versions": [
                "15"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3",
            "target": {
                "file": "tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "9652668052313215211809457435577099329",
                    "42302541755554764317914228322417196827",
                    "182510943443562764666308444493969446172",
                    "268510628125414722993030442318504867595",
                    "102830875642936636489652925739976357282",
                    "122815770119339302529597811558588685136",
                    "231546043599135225282422895037581395220"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-de1e6631",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "320482628526730975322324512763471195204",
                "length": 5039
            },
            "id": "ASB-A-487522353-eb31bad5",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java",
                "function": "onCreate"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "50448111178302970871280963852843707910",
                    "73631506534017129656694136800952130062",
                    "272470036045758090437155815418827724949",
                    "159824744492675985466948094975854045731"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-218e8dc4",
            "match_only_versions": [
                "16"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737",
            "target": {
                "file": "tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "257570518455334185191298288611603367511",
                "length": 6086
            },
            "id": "ASB-A-487522353-e39e82fa",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java",
                "function": "onCreate"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "9652668052313215211809457435577099329",
                    "42302541755554764317914228322417196827",
                    "182510943443562764666308444493969446172",
                    "268510628125414722993030442318504867595",
                    "102830875642936636489652925739976357282",
                    "122815770119339302529597811558588685136",
                    "231546043599135225282422895037581395220"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-e61efb9b",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/83dbc69ae56bdd5dfdb562f44a86f488378e40fe"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "9652668052313215211809457435577099329",
                    "42302541755554764317914228322417196827",
                    "182510943443562764666308444493969446172",
                    "268510628125414722993030442318504867595",
                    "102830875642936636489652925739976357282",
                    "122815770119339302529597811558588685136",
                    "231546043599135225282422895037581395220"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-480c53cf",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/83dbc69ae56bdd5dfdb562f44a86f488378e40fe",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "270794111176202381152047372900889284977",
                "length": 5955
            },
            "id": "ASB-A-487522353-c8c65ff9",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/83dbc69ae56bdd5dfdb562f44a86f488378e40fe",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java",
                "function": "onCreate"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "9652668052313215211809457435577099329",
                    "42302541755554764317914228322417196827",
                    "182510943443562764666308444493969446172",
                    "268510628125414722993030442318504867595",
                    "102830875642936636489652925739976357282",
                    "122815770119339302529597811558588685136",
                    "231546043599135225282422895037581395220"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-c48c9431",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "225355106264462343682862456478620329099",
                "length": 5863
            },
            "id": "ASB-A-487522353-d429800a",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java",
                "function": "onCreate"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "50448111178302970871280963852843707910",
                    "73631506534017129656694136800952130062",
                    "272470036045758090437155815418827724949",
                    "159824744492675985466948094975854045731"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-f97d7f66",
            "match_only_versions": [
                "17"
            ],
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205",
            "target": {
                "file": "tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/319bd99e56dbc79207713063fe8a19bbe9f71f72"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "36075075032965457562063846557597081223",
                "length": 3198
            },
            "id": "ASB-A-487522353-23b50908",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/319bd99e56dbc79207713063fe8a19bbe9f71f72",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java",
                "function": "onCreate"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "287616441439893114008460994366789998014",
                    "294793562361303601986062338465746709359",
                    "147597210763174070709041303428320196360",
                    "130210970787776341656751929764056254081",
                    "79856535076905567870523655038863588052",
                    "334101330933833103231535792610573397536",
                    "263087673580089959162153258465159764742"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-487522353-67892b56",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/319bd99e56dbc79207713063fe8a19bbe9f71f72",
            "target": {
                "file": "src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"