ASB-A-494816520

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-494816520.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-494816520
Aliases
  • A-494816520
  • CVE-2026-58866
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:18Z
Summary
[none]
Details

In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/69a79cb864f32857551e9136ce7108851905e006",
        "https://android.googlesource.com/platform/frameworks/base/+/9e458ec2c588eadd795021f9e86d399cad4a61aa",
        "https://android.googlesource.com/platform/frameworks/base/+/e4e8436fb52f7ea38de23d648dc7a6522bf85ada"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "319706674090344144939008815701665105604",
                "length":  378
            },
            "id":  "ASB-A-494816520-26853691",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/69a79cb864f32857551e9136ce7108851905e006",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java",
                "function":  "setAccessibilityWindowAttributes"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "217980531311019090734429633640303734046",
                    "68741872064083167940658700558191218017",
                    "98078994255493298976798976060403707768",
                    "162140218980256425254110902192299393812",
                    "7474240321895449813703930770124389380",
                    "73960224587453101053839561796378423800",
                    "128240184502810986844828742580073358223",
                    "242337800073271855722835476679524905046",
                    "222066037001459442955344097280258097427",
                    "327299883041021120488882912285211478183",
                    "10400758185695711528037182052583211734",
                    "44832381617186141360758147809147506336"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-494816520-382c0b5f",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/69a79cb864f32857551e9136ce7108851905e006",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "257773990650173923165940889237197306438",
                "length":  600
            },
            "id":  "ASB-A-494816520-b01ff718",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/e4e8436fb52f7ea38de23d648dc7a6522bf85ada",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java",
                "function":  "setAccessibilityWindowAttributes"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "167073875716824428784932562286258925199",
                    "184572066607556284495911827325818566087",
                    "217130234232790505028403097399995170265",
                    "98051424859740618327818129433403322705"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-494816520-bf84cbf2",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/e4e8436fb52f7ea38de23d648dc7a6522bf85ada",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/c7764051a1f052234f243a3081a047e53e3755ff"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "217980531311019090734429633640303734046",
                    "68741872064083167940658700558191218017",
                    "98078994255493298976798976060403707768",
                    "162140218980256425254110902192299393812",
                    "7474240321895449813703930770124389380",
                    "73960224587453101053839561796378423800",
                    "128240184502810986844828742580073358223",
                    "242337800073271855722835476679524905046",
                    "222066037001459442955344097280258097427",
                    "327299883041021120488882912285211478183",
                    "10400758185695711528037182052583211734",
                    "44832381617186141360758147809147506336"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-494816520-20ea0086",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/c7764051a1f052234f243a3081a047e53e3755ff",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "319706674090344144939008815701665105604",
                "length":  378
            },
            "id":  "ASB-A-494816520-f5dc579a",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/c7764051a1f052234f243a3081a047e53e3755ff",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java",
                "function":  "setAccessibilityWindowAttributes"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/8a96f9327b4c0ee74df6c3deb3577b1e39363775"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "319706674090344144939008815701665105604",
                "length":  378
            },
            "id":  "ASB-A-494816520-df83847d",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/8a96f9327b4c0ee74df6c3deb3577b1e39363775",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java",
                "function":  "setAccessibilityWindowAttributes"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "217980531311019090734429633640303734046",
                    "68741872064083167940658700558191218017",
                    "98078994255493298976798976060403707768",
                    "162140218980256425254110902192299393812",
                    "7474240321895449813703930770124389380",
                    "73960224587453101053839561796378423800",
                    "128240184502810986844828742580073358223",
                    "242337800073271855722835476679524905046",
                    "222066037001459442955344097280258097427",
                    "327299883041021120488882912285211478183",
                    "10400758185695711528037182052583211734",
                    "44832381617186141360758147809147506336"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-494816520-f3894121",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/8a96f9327b4c0ee74df6c3deb3577b1e39363775",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/934e642d37093708c4c801f9f86d6ffce81c0fd2"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "217980531311019090734429633640303734046",
                    "68741872064083167940658700558191218017",
                    "98078994255493298976798976060403707768",
                    "162140218980256425254110902192299393812",
                    "7474240321895449813703930770124389380",
                    "73960224587453101053839561796378423800",
                    "128240184502810986844828742580073358223",
                    "242337800073271855722835476679524905046",
                    "222066037001459442955344097280258097427",
                    "327299883041021120488882912285211478183",
                    "10400758185695711528037182052583211734",
                    "44832381617186141360758147809147506336"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-494816520-a55f01a3",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/934e642d37093708c4c801f9f86d6ffce81c0fd2",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "319706674090344144939008815701665105604",
                "length":  378
            },
            "id":  "ASB-A-494816520-f175738e",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/934e642d37093708c4c801f9f86d6ffce81c0fd2",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java",
                "function":  "setAccessibilityWindowAttributes"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/5f412bc43e7a0b0171ff825fa7f38b04a35b30ce"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "319706674090344144939008815701665105604",
                "length":  378
            },
            "id":  "ASB-A-494816520-4ac35a12",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/5f412bc43e7a0b0171ff825fa7f38b04a35b30ce",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java",
                "function":  "setAccessibilityWindowAttributes"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "217980531311019090734429633640303734046",
                    "68741872064083167940658700558191218017",
                    "98078994255493298976798976060403707768",
                    "162140218980256425254110902192299393812",
                    "7474240321895449813703930770124389380",
                    "73960224587453101053839561796378423800",
                    "128240184502810986844828742580073358223",
                    "242337800073271855722835476679524905046",
                    "222066037001459442955344097280258097427",
                    "327299883041021120488882912285211478183",
                    "10400758185695711528037182052583211734",
                    "44832381617186141360758147809147506336"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-494816520-c3922008",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/5f412bc43e7a0b0171ff825fa7f38b04a35b30ce",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/023a6ddaf0dfc4af599023f2f44817b8053a8e01"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "319706674090344144939008815701665105604",
                "length":  378
            },
            "id":  "ASB-A-494816520-14f18eea",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/023a6ddaf0dfc4af599023f2f44817b8053a8e01",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java",
                "function":  "setAccessibilityWindowAttributes"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "217980531311019090734429633640303734046",
                    "68741872064083167940658700558191218017",
                    "98078994255493298976798976060403707768",
                    "162140218980256425254110902192299393812",
                    "7474240321895449813703930770124389380",
                    "73960224587453101053839561796378423800",
                    "128240184502810986844828742580073358223",
                    "242337800073271855722835476679524905046",
                    "222066037001459442955344097280258097427",
                    "327299883041021120488882912285211478183",
                    "10400758185695711528037182052583211734",
                    "44832381617186141360758147809147506336"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-494816520-ea062818",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/023a6ddaf0dfc4af599023f2f44817b8053a8e01",
            "target":  {
                "file":  "services/accessibility/java/com/android/server/accessibility/AccessibilityWindowManager.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-494816520.json"