ASB-A-505203996
See a problem?- Import Source
- https://storage.googleapis.com/android-osv/ASB-A-505203996.json
- JSON Data
- https://api.osv.dev/v1/vulns/ASB-A-505203996
- Aliases
-
- A-505203996
- CVE-2026-55289
- Published
- 2026-11-01T00:00:00Z
- Modified
- 2026-11-02T16:56:28Z
- Summary
- [none]
- Details
-
In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- References
Affected packages
Android / platform/packages/services/Telecomm
Package
Ecosystem specific
{
"fixes": [
"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "330315130932522360784747181487816530920",
"length": 287
},
"id": "ASB-A-505203996-1ed81ab6",
"match_only_versions": [
"17-qpr2-next"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "src/com/android/server/telecom/TelecomServiceImpl.java",
"function": "isPrivilegedDialerCalling"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295712094137804635205810278931496000458",
"length": 407
},
"id": "ASB-A-505203996-33e80638",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "src/com/android/server/telecom/TelecomServiceImpl.java",
"function": "canCallPhone"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"86278727861197139604671893229060424621",
"103766434882346259814728050165405437505",
"234504008221683615009177537819868366400",
"92515587208316795308991249841478771306",
"69716668344983655770162293817504341487",
"48416785219082061250808708873163493378",
"45650031370359766663826475779683718154",
"142987263936802276706160726272810418353",
"193628616257204987446523787817527616332",
"309369494472123450681838919540963304045",
"218369141499899838781240123060173072054",
"6249721980892984414849712123497377303",
"243536576043052723022382113460783169736",
"80451506911237754867416745900263328170",
"80724333720435303056576763340845266400",
"319011713610100120864939992360009683939",
"12001071865962451999073060072627413515",
"257658228199479444816923161032889276286",
"35240001829098591109843888949307083210"
],
"threshold": 0.9
},
"id": "ASB-A-505203996-42c8c6bc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "shim/src/com/android/server/telecom/components/UserCallActivity.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"50695453196511917667382222915167439542",
"272086397273914182336634860434661176822",
"200698477459139337055977027095292128212",
"90141269349917598685359379552506181967"
],
"threshold": 0.9
},
"id": "ASB-A-505203996-5eaf0ae2",
"match_only_versions": [
"17-qpr2-next"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "323176036711350709855376518473680491912",
"length": 3395
},
"id": "ASB-A-505203996-6b4848cb",
"match_only_versions": [
"17-qpr2-next"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java",
"function": "evaluateCall"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "331385506515775265558732758139538512725",
"length": 513
},
"id": "ASB-A-505203996-6f782566",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java",
"function": "onCreate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"174158765299844124862182486439794315587",
"294865490144327236354505462175307729585",
"154701552172875255828056385180029400413",
"282100032885274639554194341970058983963",
"171124136203903482151304339303388538750",
"212198880264034643598445223044439501437",
"206458414995876812280768179639101306925",
"329391719045896626815104727658732290078",
"252716857351176541831830684124242156724",
"223353076577811774688916603567421288556",
"334003929268480117611375380446140343729",
"226454840075806144798465516219575123924",
"291169693121892326246353889426833768395",
"184026378660447282904299984341827822005",
"142878841133625634987164990152496923377",
"199398547060826680043193663774472747630",
"335648399029946842055827149653375901290",
"106819061933740884976984181160246624859",
"213651187607373246609274529685428814716",
"141391334662881615769053942429005152198",
"250052718377858165254528258080305220096",
"281299525101955639516243683589380377121",
"126470771980775024067872490708988041849",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "ASB-A-505203996-774663b4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "240605221182393886588539899514619758048",
"length": 402
},
"id": "ASB-A-505203996-b5ae9364",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "shim/src/com/android/server/telecom/components/UserCallActivity.java",
"function": "onCreate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211606276810484770850335400062363720648",
"208029519138830534075153600342797647095",
"49910670201577065668438323373258281225",
"212449657643427366064019303224402410465",
"200433922445479970685364476649083516722",
"37466961728406674403279944156737363576",
"128040321331304509027012639690330862672",
"84665339305936974132918708462822274898",
"198653903060236862370455849760178000090",
"267780876264562307033453634237472480254",
"245002908388018266800826644200589145972",
"151166777004075194442125827304301777280",
"226138919854692382020361725630530615925",
"306064304924570502954231156251315144581",
"123787832335589096071169277345227123243",
"43163942321134570520094006480075930320",
"231062644332274203393143252018489583210",
"65900374074704959880361816702164331516",
"1940933418998956496677517011395907334",
"290257482944060423318858568018666373918",
"42861667117885092653915698266671293744",
"325237034809324114931913038604212543510",
"42687180638943089901085023415870552346",
"229091512329938673298048244250437767090",
"39437940744165216598041809419395730966",
"49972917257305688207505237252462705470",
"168846663661885879776292167690822831118",
"19942330904931449819666157497822824989",
"5352145155968974949146155114994691872",
"71213782818208411621331524956476590892",
"74125085547040839270481520649481066054",
"216759101321050414572302443584326964221",
"313716507106706704845400636629083467301",
"115700971515451193416402783396439007461",
"1100794366951065722690305627346689872",
"334910930580624831346148765740764517425",
"205207896246053102986634230757109838338",
"74641304081934351207167371350069938556",
"335777800183651497369059224788356919682",
"172310961955298760571850989084888564608",
"167440586512384540725453599750191482598",
"101065513537398550422398073860005781861",
"132358025902736832135776783458677104372",
"23223460542096636811488640541404017453",
"175898472054875948418032079417714943765",
"240038912123859328756881310510379930081",
"230596331461920213185110415673702975716",
"262349375935787992936486003242721178693",
"42008630169433739829497722439383527278",
"214970976169313070613719100687100639671",
"202557024206086899536646162163561932232",
"237962361949789119224438660020119595466",
"28596955379224888003298913676426171137",
"237373438958482878177039912373166182267",
"45822501124873862512616495515827442413",
"335943456201435223554115798408444771743",
"105629498571838687917492431227196817296",
"124133484266256358898672596735952455270",
"332440396655864344600237596462501881406",
"170861106833961075340615141014447051417",
"100295546031401840307877216740584035038"
],
"threshold": 0.9
},
"id": "ASB-A-505203996-d1b104c2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "src/com/android/server/telecom/TelecomServiceImpl.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "71842551649817028901445745690455959475",
"length": 2199
},
"id": "ASB-A-505203996-f6fff2ef",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634",
"target": {
"file": "src/com/android/server/telecom/TelecomServiceImpl.java",
"function": "placeCall"
}
}
]
}
Android / platform/packages/services/Telecomm
Package
Ecosystem specific
{
"fixes": [
"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "71842551649817028901445745690455959475",
"length": 2199
},
"id": "ASB-A-505203996-003ce308",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "src/com/android/server/telecom/TelecomServiceImpl.java",
"function": "placeCall"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"252716857351176541831830684124242156724",
"223353076577811774688916603567421288556",
"334003929268480117611375380446140343729",
"226454840075806144798465516219575123924",
"199398547060826680043193663774472747630",
"335648399029946842055827149653375901290",
"106819061933740884976984181160246624859",
"213651187607373246609274529685428814716",
"141391334662881615769053942429005152198",
"250052718377858165254528258080305220096",
"281299525101955639516243683589380377121",
"126470771980775024067872490708988041849",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "ASB-A-505203996-11bb61aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "1191534197891038414758743629728348917",
"length": 91
},
"id": "ASB-A-505203996-2e9c78e0",
"match_only_versions": [
"17"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "src/com/android/server/telecom/TelecomServiceImpl.java",
"function": "canCallPhone"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"50695453196511917667382222915167439542",
"272086397273914182336634860434661176822",
"200698477459139337055977027095292128212",
"90141269349917598685359379552506181967"
],
"threshold": 0.9
},
"id": "ASB-A-505203996-61018b70",
"match_only_versions": [
"17"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"92515587208316795308991249841478771306",
"69716668344983655770162293817504341487",
"48416785219082061250808708873163493378",
"243536576043052723022382113460783169736",
"80451506911237754867416745900263328170",
"80724333720435303056576763340845266400",
"319011713610100120864939992360009683939"
],
"threshold": 0.9
},
"id": "ASB-A-505203996-6f1231cf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "shim/src/com/android/server/telecom/components/UserCallActivity.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "331385506515775265558732758139538512725",
"length": 513
},
"id": "ASB-A-505203996-715dfc7e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java",
"function": "onCreate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "240605221182393886588539899514619758048",
"length": 402
},
"id": "ASB-A-505203996-79e1e6cd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "shim/src/com/android/server/telecom/components/UserCallActivity.java",
"function": "onCreate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "330315130932522360784747181487816530920",
"length": 287
},
"id": "ASB-A-505203996-8bd22a5e",
"match_only_versions": [
"17"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "src/com/android/server/telecom/TelecomServiceImpl.java",
"function": "isPrivilegedDialerCalling"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "323176036711350709855376518473680491912",
"length": 3395
},
"id": "ASB-A-505203996-c12aefd4",
"match_only_versions": [
"17"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java",
"function": "evaluateCall"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"200433922445479970685364476649083516722",
"37466961728406674403279944156737363576",
"128040321331304509027012639690330862672",
"84665339305936974132918708462822274898",
"198653903060236862370455849760178000090",
"267780876264562307033453634237472480254",
"65900374074704959880361816702164331516",
"1940933418998956496677517011395907334",
"290257482944060423318858568018666373918",
"42861667117885092653915698266671293744",
"325237034809324114931913038604212543510",
"42687180638943089901085023415870552346",
"229091512329938673298048244250437767090",
"39437940744165216598041809419395730966",
"49972917257305688207505237252462705470",
"168846663661885879776292167690822831118",
"19942330904931449819666157497822824989",
"5352145155968974949146155114994691872",
"71213782818208411621331524956476590892",
"74125085547040839270481520649481066054",
"216759101321050414572302443584326964221",
"313716507106706704845400636629083467301",
"115700971515451193416402783396439007461",
"1100794366951065722690305627346689872",
"334910930580624831346148765740764517425",
"205207896246053102986634230757109838338",
"74641304081934351207167371350069938556",
"335777800183651497369059224788356919682",
"172310961955298760571850989084888564608",
"167440586512384540725453599750191482598",
"101065513537398550422398073860005781861",
"132358025902736832135776783458677104372",
"13185319101264593172080308982356280931",
"143606030375037241194193185918268659158",
"311557270563434180769956070890341126138",
"23223460542096636811488640541404017453",
"175898472054875948418032079417714943765",
"240038912123859328756881310510379930081",
"230596331461920213185110415673702975716",
"262349375935787992936486003242721178693",
"42008630169433739829497722439383527278",
"214970976169313070613719100687100639671",
"202557024206086899536646162163561932232",
"237962361949789119224438660020119595466",
"28596955379224888003298913676426171137",
"237373438958482878177039912373166182267",
"45822501124873862512616495515827442413",
"105629498571838687917492431227196817296",
"124133484266256358898672596735952455270",
"332440396655864344600237596462501881406",
"170861106833961075340615141014447051417",
"100295546031401840307877216740584035038"
],
"threshold": 0.9
},
"id": "ASB-A-505203996-cdb7475c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "src/com/android/server/telecom/TelecomServiceImpl.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295712094137804635205810278931496000458",
"length": 407
},
"id": "ASB-A-505203996-d5d49f3f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "src/com/android/server/telecom/TelecomServiceImpl.java",
"function": "canCallPhone"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "297037854016735136514187153206101819123",
"length": 317
},
"id": "ASB-A-505203996-e92e0ac4",
"match_only_versions": [
"17"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b",
"target": {
"file": "TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java",
"function": "verifyCallAction"
}
}
]
}