In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/fc70c981d930651ef97869fb8ef53e13c3955fd7"
],
"severity": "High",
"spl": "2026-10-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "148550296815065917508865521127464865920",
"length": 439
},
"id": "ASB-A-514740359-a871b73c",
"match_only_versions": [
"17-next"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/fc70c981d930651ef97869fb8ef53e13c3955fd7",
"target": {
"file": "service/java/com/android/server/wifi/util/WifiPermissionsUtil.java",
"function": "isSystem"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"51124359150598412160642453064496719863",
"321631950264235806702616019206494189656",
"169868443419142260241445034468829581968",
"19723639718491979895464785505323070354"
],
"threshold": 0.9
},
"id": "ASB-A-514740359-cf16b7b3",
"match_only_versions": [
"17-next"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/fc70c981d930651ef97869fb8ef53e13c3955fd7",
"target": {
"file": "service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"
}
}
]
}
{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/8d8ed6f0ea1d2260b924b09dd07d312736d87866"
],
"severity": "High",
"spl": "2026-10-01",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "148550296815065917508865521127464865920",
"length": 439
},
"id": "ASB-A-514740359-074195a1",
"match_only_versions": [
"17"
],
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/8d8ed6f0ea1d2260b924b09dd07d312736d87866",
"target": {
"file": "service/java/com/android/server/wifi/util/WifiPermissionsUtil.java",
"function": "isSystem"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"51124359150598412160642453064496719863",
"321631950264235806702616019206494189656",
"169868443419142260241445034468829581968",
"19723639718491979895464785505323070354"
],
"threshold": 0.9
},
"id": "ASB-A-514740359-78b295f4",
"match_only_versions": [
"17"
],
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/8d8ed6f0ea1d2260b924b09dd07d312736d87866",
"target": {
"file": "service/java/com/android/server/wifi/util/WifiPermissionsUtil.java"
}
}
]
}