ASB-A-499298430

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-499298430.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-499298430
Aliases
  • A-499298430
  • CVE-2026-55271
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:20Z
Summary
[none]
Details

In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/packages/apps/ContactsPicker

Package

Name
platform/packages/apps/ContactsPicker

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/apps/ContactsPicker/+/31861c55010495d50bf461258cc6ac55e41a0476"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-499298430.json"

Android / platform/packages/apps/ContactsPicker

Package

Name
platform/packages/apps/ContactsPicker

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/apps/ContactsPicker/+/fef6b896271de5441ac33c9f073c1b81108e9638"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-499298430.json"