ASB-A-500368515

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-500368515.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-500368515
Aliases
  • A-500368515
  • CVE-2026-58957
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T17:11:25Z
Summary
[none]
Details

In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/038570272e1bffb436ba462a17019ee1591e6ea2"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "208541534460384948833338299093157541976",
                "length":  2513
            },
            "id":  "ASB-A-500368515-2e881220",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/038570272e1bffb436ba462a17019ee1591e6ea2",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function":  "resolveToHeavyWeightSwitcherIfNeeded"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "262393294667374548033073179435608603727",
                    "185767816261428529599732507358338687409",
                    "2794047396836808824727809203415499785",
                    "328319832459946279802342749576007426665",
                    "76711921162984927464940564694963012342",
                    "114453219737195865279216126144651768457",
                    "127969907326923251870947243259122396355",
                    "177747119237921070628884928215625249740",
                    "251165073482809034947053272683998112528",
                    "335217149137500581974031050117146731004",
                    "188787713035632447775610434457095139296",
                    "284865945246284946780412976973192343533",
                    "147702096036081541563886442426695764811",
                    "95324265733025569373517630511986400327",
                    "264129475696548534827926576125744390365",
                    "246966273701212530409304353138918305123",
                    "113757763372197570081243132480577431092"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-500368515-348ada24",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/038570272e1bffb436ba462a17019ee1591e6ea2",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/fd53cee662011b8c941ed128c46da310c01d5625"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "121627612520486245863375107390968337961",
                    "293768016984612675264427475236103031404",
                    "2794047396836808824727809203415499785",
                    "328319832459946279802342749576007426665",
                    "76711921162984927464940564694963012342",
                    "114453219737195865279216126144651768457",
                    "127969907326923251870947243259122396355",
                    "177747119237921070628884928215625249740",
                    "338460634918020054896853830242271131569",
                    "31954128021861864275942091384272148764",
                    "290241155291904266061664649701699576592",
                    "206134399752924949617700129147085569876",
                    "147702096036081541563886442426695764811",
                    "95324265733025569373517630511986400327",
                    "264129475696548534827926576125744390365",
                    "246966273701212530409304353138918305123",
                    "113757763372197570081243132480577431092"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-500368515-4273cc51",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/fd53cee662011b8c941ed128c46da310c01d5625",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "168741367883641637588844732969743879242",
                "length":  2536
            },
            "id":  "ASB-A-500368515-61f07508",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/fd53cee662011b8c941ed128c46da310c01d5625",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function":  "resolveToHeavyWeightSwitcherIfNeeded"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/842a7d49c6355280a3e60ff55bd3798a4ba6ba0f"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "262393294667374548033073179435608603727",
                    "185767816261428529599732507358338687409",
                    "2794047396836808824727809203415499785",
                    "328319832459946279802342749576007426665",
                    "76711921162984927464940564694963012342",
                    "114453219737195865279216126144651768457",
                    "127969907326923251870947243259122396355",
                    "177747119237921070628884928215625249740",
                    "338460634918020054896853830242271131569",
                    "31954128021861864275942091384272148764",
                    "290241155291904266061664649701699576592",
                    "206134399752924949617700129147085569876",
                    "147702096036081541563886442426695764811",
                    "95324265733025569373517630511986400327",
                    "264129475696548534827926576125744390365",
                    "246966273701212530409304353138918305123",
                    "113757763372197570081243132480577431092"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-500368515-91401fe5",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/842a7d49c6355280a3e60ff55bd3798a4ba6ba0f",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "168741367883641637588844732969743879242",
                "length":  2536
            },
            "id":  "ASB-A-500368515-dd607f97",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/842a7d49c6355280a3e60ff55bd3798a4ba6ba0f",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function":  "resolveToHeavyWeightSwitcherIfNeeded"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/7dfe78705e17c1fcc80bba541910516369d7579e"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "168741367883641637588844732969743879242",
                "length":  2536
            },
            "id":  "ASB-A-500368515-5189ea5e",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/7dfe78705e17c1fcc80bba541910516369d7579e",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function":  "resolveToHeavyWeightSwitcherIfNeeded"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "262393294667374548033073179435608603727",
                    "185767816261428529599732507358338687409",
                    "2794047396836808824727809203415499785",
                    "328319832459946279802342749576007426665",
                    "76711921162984927464940564694963012342",
                    "114453219737195865279216126144651768457",
                    "127969907326923251870947243259122396355",
                    "177747119237921070628884928215625249740",
                    "338460634918020054896853830242271131569",
                    "31954128021861864275942091384272148764",
                    "290241155291904266061664649701699576592",
                    "206134399752924949617700129147085569876",
                    "147702096036081541563886442426695764811",
                    "95324265733025569373517630511986400327",
                    "264129475696548534827926576125744390365",
                    "246966273701212530409304353138918305123",
                    "113757763372197570081243132480577431092"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-500368515-72e36dc5",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/7dfe78705e17c1fcc80bba541910516369d7579e",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/f9391d85900cc3200fa14f6bc1ca52932454c0ab"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "208541534460384948833338299093157541976",
                "length":  2513
            },
            "id":  "ASB-A-500368515-50c14f21",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/f9391d85900cc3200fa14f6bc1ca52932454c0ab",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function":  "resolveToHeavyWeightSwitcherIfNeeded"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "262393294667374548033073179435608603727",
                    "185767816261428529599732507358338687409",
                    "2794047396836808824727809203415499785",
                    "328319832459946279802342749576007426665",
                    "76711921162984927464940564694963012342",
                    "114453219737195865279216126144651768457",
                    "127969907326923251870947243259122396355",
                    "177747119237921070628884928215625249740",
                    "251165073482809034947053272683998112528",
                    "335217149137500581974031050117146731004",
                    "188787713035632447775610434457095139296",
                    "284865945246284946780412976973192343533",
                    "147702096036081541563886442426695764811",
                    "95324265733025569373517630511986400327",
                    "264129475696548534827926576125744390365",
                    "246966273701212530409304353138918305123",
                    "113757763372197570081243132480577431092"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-500368515-c5d34457",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/f9391d85900cc3200fa14f6bc1ca52932454c0ab",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/53f78b87480a894abb2806a2b101a91fced08d33"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "121627612520486245863375107390968337961",
                    "293768016984612675264427475236103031404",
                    "2794047396836808824727809203415499785",
                    "328319832459946279802342749576007426665",
                    "76711921162984927464940564694963012342",
                    "114453219737195865279216126144651768457",
                    "127969907326923251870947243259122396355",
                    "177747119237921070628884928215625249740",
                    "338460634918020054896853830242271131569",
                    "31954128021861864275942091384272148764",
                    "290241155291904266061664649701699576592",
                    "206134399752924949617700129147085569876",
                    "147702096036081541563886442426695764811",
                    "95324265733025569373517630511986400327",
                    "264129475696548534827926576125744390365",
                    "246966273701212530409304353138918305123",
                    "113757763372197570081243132480577431092"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-500368515-7464727b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/53f78b87480a894abb2806a2b101a91fced08d33",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "168741367883641637588844732969743879242",
                "length":  2536
            },
            "id":  "ASB-A-500368515-c4667edd",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/53f78b87480a894abb2806a2b101a91fced08d33",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityStarter.java",
                "function":  "resolveToHeavyWeightSwitcherIfNeeded"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"