ASB-A-527034642

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-527034642.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-527034642
Aliases
  • A-527034642
  • CVE-2026-58946
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T17:11:17Z
Summary
[none]
Details

In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "66626885679975416344591914439836620015",
                    "298236227127430811248567657295975947972",
                    "120841021482464668877120412446517404938"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527034642-0721f6b5",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityClientController.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "277225765274953645649780085194809424659",
                "length":  563
            },
            "id":  "ASB-A-527034642-3a6995d0",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityClientController.java",
                "function":  "navigateUpTo"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "212705663238405843186232430908729797371",
                    "145940515004624220457202624962566216435",
                    "188983668635749986684791873535020721219",
                    "210239609107509905147133540988850388150"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527034642-84b85d6e",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366",
            "target":  {
                "file":  "services/tests/wmtests/src/com/android/server/wm/SystemServicesTestRule.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527034642.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/251949ef9f045abc67c169dd0cceb076ad9d9c7e"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "308109601750817782096252523506789553926",
                    "332618966041723367115481096434693326044",
                    "252549206848878189123090693328808540697"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527034642-bd6b877f",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/251949ef9f045abc67c169dd0cceb076ad9d9c7e",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityClientController.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "243161130442187690972303800278616305359",
                "length":  461
            },
            "id":  "ASB-A-527034642-e7e2da49",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/251949ef9f045abc67c169dd0cceb076ad9d9c7e",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityClientController.java",
                "function":  "navigateUpTo"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527034642.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/072555e9730d029a38a72128be46831889dc426e"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "243161130442187690972303800278616305359",
                "length":  461
            },
            "id":  "ASB-A-527034642-7f36e996",
            "match_only_versions":  [
                "16-qpr2"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/072555e9730d029a38a72128be46831889dc426e",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityClientController.java",
                "function":  "navigateUpTo"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "308109601750817782096252523506789553926",
                    "332618966041723367115481096434693326044",
                    "252549206848878189123090693328808540697"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527034642-c3c6f547",
            "match_only_versions":  [
                "16-qpr2"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/072555e9730d029a38a72128be46831889dc426e",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityClientController.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527034642.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/9315367cd50d1e5434efd4a818193322f915f210"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "308109601750817782096252523506789553926",
                    "332618966041723367115481096434693326044",
                    "252549206848878189123090693328808540697"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527034642-6348d546",
            "match_only_versions":  [
                "17"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/9315367cd50d1e5434efd4a818193322f915f210",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityClientController.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "243161130442187690972303800278616305359",
                "length":  461
            },
            "id":  "ASB-A-527034642-93aa435a",
            "match_only_versions":  [
                "17"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/9315367cd50d1e5434efd4a818193322f915f210",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/ActivityClientController.java",
                "function":  "navigateUpTo"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527034642.json"