ASB-A-498916138

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-498916138.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-498916138

Aliases

A-498916138
CVE-2026-28657

Published

2026-09-01T00:00:00Z

Modified

2026-09-09T15:15:54Z

Summary

[none]

Details

In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2026-09-01

Affected packages

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17-next:0

Fixed

17-next:2026-09-01

Affected versions

Other

17-next

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/e2c75d70260ad97f24feef6b8ec1a0ebfe364347"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "function_hash": "311704568954905544218201527300819541202",
                "length": 286
            },
            "id": "ASB-A-498916138-6cd6a46e",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e2c75d70260ad97f24feef6b8ec1a0ebfe364347",
            "target": {
                "file": "core/java/android/appwidget/AppWidgetConfigActivityProxy.java",
                "function": "onActivityResult"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "237016630149306421452840928473007703053",
                    "50143385128495565907010397505966602007",
                    "88100196006281129937411128248127776562",
                    "140559082213086012803180817233321705467",
                    "228608869399389294870407046796633210727",
                    "74252292172099829220238198815578687459",
                    "224263778142613551284112330002219923970",
                    "175302810258537392142677048446428414616",
                    "84568215179344273222986484452005504446",
                    "282088641526453108010441287455962860942",
                    "4852878632377954103182448372210044214"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-498916138-c290cb35",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e2c75d70260ad97f24feef6b8ec1a0ebfe364347",
            "target": {
                "file": "core/java/android/appwidget/AppWidgetConfigActivityProxy.java"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-498916138.json"

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16-qpr2:0

Fixed

16-qpr2:2026-09-01

Affected versions

Other

16-qpr2

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/7c0b971945321ee139c71abb27c77732737c5b0f"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "175302810258537392142677048446428414616",
                    "84568215179344273222986484452005504446",
                    "282088641526453108010441287455962860942",
                    "4852878632377954103182448372210044214"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-498916138-0802f198",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7c0b971945321ee139c71abb27c77732737c5b0f",
            "target": {
                "file": "core/java/android/appwidget/AppWidgetConfigActivityProxy.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "311704568954905544218201527300819541202",
                "length": 286
            },
            "id": "ASB-A-498916138-e37995a4",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7c0b971945321ee139c71abb27c77732737c5b0f",
            "target": {
                "file": "core/java/android/appwidget/AppWidgetConfigActivityProxy.java",
                "function": "onActivityResult"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-498916138.json"

Android / platform/frameworks/base

Package

Name: platform/frameworks/base

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17:0

Fixed

17:2026-09-01

Affected versions

Other

Ecosystem specific

{
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/80e84dab91f60a4c7175759802b30d4ad3241c39"
    ],
    "severity": "High",
    "spl": "2026-09-01",
    "types": [
        "EoP"
    ],
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "237016630149306421452840928473007703053",
                    "50143385128495565907010397505966602007",
                    "88100196006281129937411128248127776562",
                    "140559082213086012803180817233321705467",
                    "228608869399389294870407046796633210727",
                    "74252292172099829220238198815578687459",
                    "224263778142613551284112330002219923970",
                    "175302810258537392142677048446428414616",
                    "84568215179344273222986484452005504446",
                    "282088641526453108010441287455962860942",
                    "4852878632377954103182448372210044214"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-498916138-31760a5b",
            "signature_type": "Line",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/80e84dab91f60a4c7175759802b30d4ad3241c39",
            "target": {
                "file": "core/java/android/appwidget/AppWidgetConfigActivityProxy.java"
            }
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "311704568954905544218201527300819541202",
                "length": 286
            },
            "id": "ASB-A-498916138-a71eb1a6",
            "signature_type": "Function",
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/80e84dab91f60a4c7175759802b30d4ad3241c39",
            "target": {
                "file": "core/java/android/appwidget/AppWidgetConfigActivityProxy.java",
                "function": "onActivityResult"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-498916138.json"