ASB-A-496735702

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-496735702.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-496735702
Aliases
  • A-496735702
  • CVE-2026-28574
Published
2026-06-01T00:00:00Z
Modified
2026-06-09T15:27:06.151355248Z
Summary
[none]
Details

In onServiceConnected of HostEmulationManager.java, there is a possible way to perform BAL due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-06-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "spl": "2026-06-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea"
    ],
    "vanir_signatures": [
        {
            "match_only_versions": [
                "17-next"
            ],
            "deprecated": false,
            "signature_type": "Line",
            "target": {
                "file": "NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "86688120992371390739020006842299055484",
                    "215223423322781899579547143707049384550",
                    "275464154574438694425345713387515178782",
                    "326020092990932437683134700065233243053"
                ]
            },
            "id": "ASB-A-496735702-24692715",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea"
        },
        {
            "match_only_versions": [
                "17-next"
            ],
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "function": "onServiceConnected",
                "file": "NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"
            },
            "signature_version": "v1",
            "digest": {
                "length": 1988.0,
                "function_hash": "141656006104620151990289342286865021790"
            },
            "id": "ASB-A-496735702-b9aef8bb",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496735702.json"

Android / platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-06-01

Affected versions

Other
16

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "severity": "High",
    "spl": "2026-06-01",
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e"
    ],
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "33761003995606516348867317978512480547",
                    "264491105238813284431707904219229667689",
                    "231588233561071738439720740133199140598",
                    "303451526792491032741878816960172378737"
                ]
            },
            "deprecated": false,
            "signature_type": "Line",
            "id": "ASB-A-496735702-b801f6c5",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e",
            "target": {
                "file": "NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"
            }
        },
        {
            "digest": {
                "length": 1774.0,
                "function_hash": "154034435489838502234758318852156583301"
            },
            "deprecated": false,
            "signature_type": "Function",
            "id": "ASB-A-496735702-d5f65333",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e",
            "target": {
                "function": "onServiceConnected",
                "file": "NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496735702.json"

Android / platform/packages/modules/Nfc

Package

Name
platform/packages/modules/Nfc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-06-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "severity": "High",
    "spl": "2026-06-01",
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e"
    ],
    "vanir_signatures": [
        {
            "match_only_versions": [
                "16-qpr2"
            ],
            "deprecated": false,
            "signature_type": "Line",
            "target": {
                "file": "NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"
            },
            "signature_version": "v1",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "86688120992371390739020006842299055484",
                    "215223423322781899579547143707049384550",
                    "275464154574438694425345713387515178782",
                    "326020092990932437683134700065233243053"
                ]
            },
            "id": "ASB-A-496735702-734cadce",
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e"
        },
        {
            "digest": {
                "length": 1789.0,
                "function_hash": "247534031965832360392989219577962126912"
            },
            "deprecated": false,
            "signature_type": "Function",
            "target": {
                "function": "onServiceConnected",
                "file": "NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"
            },
            "source": "https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e",
            "id": "ASB-A-496735702-f40910d8",
            "signature_version": "v1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-496735702.json"