ASB-A-527036176

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-527036176.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-527036176
Aliases
  • A-527036176
  • CVE-2026-58974
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T17:11:15Z
Summary
[none]
Details

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254756202945044017983340208008594186703",
                "length":  1409
            },
            "id":  "ASB-A-527036176-27c89c04",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f",
            "target":  {
                "file":  "core/java/android/os/Binder.java",
                "function":  "onShellCommand"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "200150622722840859512874629774355797161",
                    "334312262691176547190964272951743523005",
                    "326635729397598627440176343103780594072",
                    "7789538731787653007042207216705328657"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-464a19db",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "224412128432702335873494000300338225386",
                    "317252062471637607374019347752961870835",
                    "181573889494107209853229754953908744053",
                    "302033350515499424860335407153973995592",
                    "215187824298931299292553244399989910044",
                    "188242131689888584309477795810181248455",
                    "155519689672058273751795971522394075396",
                    "153165129434553141139131647291026347801",
                    "242128928378382133731892180874546068540",
                    "181321619002047399963138584572953430843",
                    "110530567039366567086632157752472759501"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-5c479331",
            "match_only_versions":  [
                "17-qpr2-next"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f",
            "target":  {
                "file":  "core/java/android/os/Binder.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "266863510474315262488227988797878654698",
                "length":  196
            },
            "id":  "ASB-A-527036176-61ae4709",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java",
                "function":  "onShellCommand"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "266863510474315262488227988797878654698",
                "length":  196
            },
            "id":  "ASB-A-527036176-26e4c269",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java",
                "function":  "onShellCommand"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254756202945044017983340208008594186703",
                "length":  1409
            },
            "id":  "ASB-A-527036176-6713c2cc",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60",
            "target":  {
                "file":  "core/java/android/os/Binder.java",
                "function":  "onShellCommand"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "200150622722840859512874629774355797161",
                    "334312262691176547190964272951743523005",
                    "326635729397598627440176343103780594072",
                    "32126585500871840016330705785166556816"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-c2dc9ca1",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "78679364347369504733144188217313619822",
                    "196170694888987423643355606095205774638",
                    "181478182630068703693810259999230260630",
                    "302033350515499424860335407153973995592",
                    "215187824298931299292553244399989910044",
                    "188242131689888584309477795810181248455",
                    "155519689672058273751795971522394075396",
                    "153165129434553141139131647291026347801",
                    "242128928378382133731892180874546068540",
                    "181321619002047399963138584572953430843",
                    "110530567039366567086632157752472759501"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-cc59bd00",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60",
            "target":  {
                "file":  "core/java/android/os/Binder.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "200150622722840859512874629774355797161",
                    "334312262691176547190964272951743523005",
                    "326635729397598627440176343103780594072",
                    "7789538731787653007042207216705328657"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-2226c5fc",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254756202945044017983340208008594186703",
                "length":  1409
            },
            "id":  "ASB-A-527036176-c27447b8",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d",
            "target":  {
                "file":  "core/java/android/os/Binder.java",
                "function":  "onShellCommand"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "78679364347369504733144188217313619822",
                    "196170694888987423643355606095205774638",
                    "181478182630068703693810259999230260630",
                    "302033350515499424860335407153973995592",
                    "215187824298931299292553244399989910044",
                    "188242131689888584309477795810181248455",
                    "155519689672058273751795971522394075396",
                    "153165129434553141139131647291026347801",
                    "242128928378382133731892180874546068540",
                    "181321619002047399963138584572953430843",
                    "110530567039366567086632157752472759501"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-ca0c8f6a",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d",
            "target":  {
                "file":  "core/java/android/os/Binder.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "266863510474315262488227988797878654698",
                "length":  196
            },
            "id":  "ASB-A-527036176-f5c6d681",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java",
                "function":  "onShellCommand"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "266863510474315262488227988797878654698",
                "length":  196
            },
            "id":  "ASB-A-527036176-0bbaeec5",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java",
                "function":  "onShellCommand"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "78679364347369504733144188217313619822",
                    "196170694888987423643355606095205774638",
                    "181478182630068703693810259999230260630",
                    "302033350515499424860335407153973995592",
                    "215187824298931299292553244399989910044",
                    "188242131689888584309477795810181248455",
                    "155519689672058273751795971522394075396",
                    "153165129434553141139131647291026347801",
                    "242128928378382133731892180874546068540",
                    "181321619002047399963138584572953430843",
                    "110530567039366567086632157752472759501"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-1f49cd47",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8",
            "target":  {
                "file":  "core/java/android/os/Binder.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "200150622722840859512874629774355797161",
                    "334312262691176547190964272951743523005",
                    "326635729397598627440176343103780594072",
                    "7789538731787653007042207216705328657"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-7c48c74c",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254756202945044017983340208008594186703",
                "length":  1409
            },
            "id":  "ASB-A-527036176-bf3bb7c1",
            "match_only_versions":  [
                "16-qpr2"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8",
            "target":  {
                "file":  "core/java/android/os/Binder.java",
                "function":  "onShellCommand"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "78679364347369504733144188217313619822",
                    "196170694888987423643355606095205774638",
                    "181478182630068703693810259999230260630",
                    "302033350515499424860335407153973995592",
                    "215187824298931299292553244399989910044",
                    "188242131689888584309477795810181248455",
                    "155519689672058273751795971522394075396",
                    "153165129434553141139131647291026347801",
                    "242128928378382133731892180874546068540",
                    "181321619002047399963138584572953430843",
                    "110530567039366567086632157752472759501"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-0f9f100a",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1",
            "target":  {
                "file":  "core/java/android/os/Binder.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "200150622722840859512874629774355797161",
                    "334312262691176547190964272951743523005",
                    "326635729397598627440176343103780594072",
                    "7789538731787653007042207216705328657"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-263df9a6",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254756202945044017983340208008594186703",
                "length":  1409
            },
            "id":  "ASB-A-527036176-a05eca5c",
            "match_only_versions":  [
                "17"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1",
            "target":  {
                "file":  "core/java/android/os/Binder.java",
                "function":  "onShellCommand"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "266863510474315262488227988797878654698",
                "length":  196
            },
            "id":  "ASB-A-527036176-d30c7f47",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java",
                "function":  "onShellCommand"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "266863510474315262488227988797878654698",
                "length":  196
            },
            "id":  "ASB-A-527036176-47a3bf94",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java",
                "function":  "onShellCommand"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "78679364347369504733144188217313619822",
                    "196170694888987423643355606095205774638",
                    "181478182630068703693810259999230260630",
                    "302033350515499424860335407153973995592",
                    "215187824298931299292553244399989910044",
                    "188242131689888584309477795810181248455",
                    "155519689672058273751795971522394075396",
                    "153165129434553141139131647291026347801",
                    "242128928378382133731892180874546068540",
                    "181321619002047399963138584572953430843",
                    "110530567039366567086632157752472759501"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-77635436",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417",
            "target":  {
                "file":  "core/java/android/os/Binder.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "254756202945044017983340208008594186703",
                "length":  1409
            },
            "id":  "ASB-A-527036176-8ef6ee3a",
            "match_only_versions":  [
                "14"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417",
            "target":  {
                "file":  "core/java/android/os/Binder.java",
                "function":  "onShellCommand"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "200150622722840859512874629774355797161",
                    "334312262691176547190964272951743523005",
                    "326635729397598627440176343103780594072",
                    "32126585500871840016330705785166556816"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527036176-c9d526a4",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/WindowManagerService.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"