In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/129a667d459d18de6087fedc17b21df57fa74678"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"41011992002680225704484254046408566461",
"68753636257948704893168913921840109300",
"158754264090278170454689944634813066412",
"218077851547064036058426989496463964558",
"157438371110237836723082863476749715507",
"101893895224043738552929285970134549227",
"323282908140856314906670773917487188006",
"198571416349413549326416666887353017259"
],
"threshold": 0.9
},
"id": "ASB-A-515051007-3622ea1a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/129a667d459d18de6087fedc17b21df57fa74678",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "201216292642994949247115730504281657282",
"length": 2689
},
"id": "ASB-A-515051007-3697e99a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/129a667d459d18de6087fedc17b21df57fa74678",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java",
"function": "getMessenger"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/388640744b3dfbdde0b719744b710b9170ff00f5"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "233834903035615300061690714340508153401",
"length": 1911
},
"id": "ASB-A-515051007-46ffabd4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/388640744b3dfbdde0b719744b710b9170ff00f5",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java",
"function": "getMessenger"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125369200130323565972238874801716419786",
"68753636257948704893168913921840109300",
"158754264090278170454689944634813066412",
"218077851547064036058426989496463964558",
"170231726606694727521456925942195795308",
"75133149208638875888512575203604843694",
"143636368893659827207077972271419964505",
"36412873385178232549830123427549232806"
],
"threshold": 0.9
},
"id": "ASB-A-515051007-83c6dc61",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/388640744b3dfbdde0b719744b710b9170ff00f5",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/cd08fb839525b50e715e7e77806153e045ace857"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "233834903035615300061690714340508153401",
"length": 1911
},
"id": "ASB-A-515051007-6b84089b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/cd08fb839525b50e715e7e77806153e045ace857",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java",
"function": "getMessenger"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125369200130323565972238874801716419786",
"68753636257948704893168913921840109300",
"158754264090278170454689944634813066412",
"218077851547064036058426989496463964558",
"170231726606694727521456925942195795308",
"75133149208638875888512575203604843694",
"143636368893659827207077972271419964505",
"36412873385178232549830123427549232806"
],
"threshold": 0.9
},
"id": "ASB-A-515051007-8c44ecaf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/cd08fb839525b50e715e7e77806153e045ace857",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/c5c743b38533b34d583005d67534d980241ec36e"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "233834903035615300061690714340508153401",
"length": 1911
},
"id": "ASB-A-515051007-19e49a34",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/c5c743b38533b34d583005d67534d980241ec36e",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java",
"function": "getMessenger"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125369200130323565972238874801716419786",
"68753636257948704893168913921840109300",
"158754264090278170454689944634813066412",
"218077851547064036058426989496463964558",
"170231726606694727521456925942195795308",
"75133149208638875888512575203604843694",
"143636368893659827207077972271419964505",
"36412873385178232549830123427549232806"
],
"threshold": 0.9
},
"id": "ASB-A-515051007-76087187",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/c5c743b38533b34d583005d67534d980241ec36e",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/9106972a81ebaf68ac41a505445a202505700dba"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "233834903035615300061690714340508153401",
"length": 1911
},
"id": "ASB-A-515051007-affb09be",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/9106972a81ebaf68ac41a505445a202505700dba",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java",
"function": "getMessenger"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125369200130323565972238874801716419786",
"68753636257948704893168913921840109300",
"158754264090278170454689944634813066412",
"218077851547064036058426989496463964558",
"170231726606694727521456925942195795308",
"75133149208638875888512575203604843694",
"143636368893659827207077972271419964505",
"36412873385178232549830123427549232806"
],
"threshold": 0.9
},
"id": "ASB-A-515051007-db404f37",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/9106972a81ebaf68ac41a505445a202505700dba",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/packages/modules/Wifi/+/37484941f9a653f4e2e8405a5ef84177f396181f"
],
"severity": "High",
"spl": "2026-11-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "233834903035615300061690714340508153401",
"length": 1911
},
"id": "ASB-A-515051007-0b01fd01",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/37484941f9a653f4e2e8405a5ef84177f396181f",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java",
"function": "getMessenger"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"125369200130323565972238874801716419786",
"68753636257948704893168913921840109300",
"158754264090278170454689944634813066412",
"218077851547064036058426989496463964558",
"170231726606694727521456925942195795308",
"75133149208638875888512575203604843694",
"143636368893659827207077972271419964505",
"36412873385178232549830123427549232806"
],
"threshold": 0.9
},
"id": "ASB-A-515051007-f503e721",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/packages/modules/Wifi/+/37484941f9a653f4e2e8405a5ef84177f396181f",
"target": {
"file": "service/java/com/android/server/wifi/p2p/WifiP2pServiceImpl.java"
}
}
]
}