ASB-A-491253353

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-491253353.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-491253353
Aliases
  • A-491253353
  • CVE-2026-28603
Published
2026-09-01T00:00:00Z
Modified
2026-09-08T15:39:03Z
Summary
[none]
Details

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-09-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/e2db447a6a08163c8140e56e1e604576d4fd5c5c"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "254135208065114074428372951261690934042",
                    "228182769056667432092538698315744223959",
                    "264706955376400474874447664348359889659",
                    "318696653688491585257393060833995396627"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-491253353-a07f3d53",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/e2db447a6a08163c8140e56e1e604576d4fd5c5c",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "81445960912966084671613664373860353340",
                "length": 581
            },
            "id": "ASB-A-491253353-e3c37b25",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/e2db447a6a08163c8140e56e1e604576d4fd5c5c",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-09-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/bf5e5cf1ff46bba76526fcad7e0a0af91adac560"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "81445960912966084671613664373860353340",
                "length": 581
            },
            "id": "ASB-A-491253353-093e06ef",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/bf5e5cf1ff46bba76526fcad7e0a0af91adac560",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "254135208065114074428372951261690934042",
                    "228182769056667432092538698315744223959",
                    "264706955376400474874447664348359889659",
                    "318696653688491585257393060833995396627"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-491253353-4ecf1a8f",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/bf5e5cf1ff46bba76526fcad7e0a0af91adac560",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-09-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/0a9b0b20f33499eae37981a68d527c848254245b"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "81445960912966084671613664373860353340",
                "length": 581
            },
            "id": "ASB-A-491253353-68051518",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/0a9b0b20f33499eae37981a68d527c848254245b",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "254135208065114074428372951261690934042",
                    "228182769056667432092538698315744223959",
                    "264706955376400474874447664348359889659",
                    "318696653688491585257393060833995396627"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-491253353-d5574be3",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/0a9b0b20f33499eae37981a68d527c848254245b",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-09-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/52acda89357f0596f203be1334bf90024b0ed490"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "254135208065114074428372951261690934042",
                    "228182769056667432092538698315744223959",
                    "264706955376400474874447664348359889659",
                    "318696653688491585257393060833995396627"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-491253353-1b4e3953",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52acda89357f0596f203be1334bf90024b0ed490",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "81445960912966084671613664373860353340",
                "length": 581
            },
            "id": "ASB-A-491253353-d5b12270",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/52acda89357f0596f203be1334bf90024b0ed490",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-09-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/df6c1b2471a9d23d3890a711625cf135c7c46257"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "81445960912966084671613664373860353340",
                "length": 581
            },
            "id": "ASB-A-491253353-64877f4b",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/df6c1b2471a9d23d3890a711625cf135c7c46257",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "254135208065114074428372951261690934042",
                    "228182769056667432092538698315744223959",
                    "264706955376400474874447664348359889659",
                    "318696653688491585257393060833995396627"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-491253353-ad700201",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/df6c1b2471a9d23d3890a711625cf135c7c46257",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"
platform/packages/apps/Settings

Package

Name
platform/packages/apps/Settings

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-09-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes": [
        "https://android.googlesource.com/platform/packages/apps/Settings/+/63dbf22bdba0e8d3e1671c1413462a1abd649056"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "81445960912966084671613664373860353340",
                "length": 581
            },
            "id": "ASB-A-491253353-1e022709",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/63dbf22bdba0e8d3e1671c1413462a1abd649056",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java",
                "function": "assertSafeToStartCustomActivity"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "254135208065114074428372951261690934042",
                    "228182769056667432092538698315744223959",
                    "264706955376400474874447664348359889659",
                    "318696653688491585257393060833995396627"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-491253353-56e0749c",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/apps/Settings/+/63dbf22bdba0e8d3e1671c1413462a1abd649056",
            "target": {
                "file": "src/com/android/settings/users/AppRestrictionsFragment.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"