{"id":"ASB-A-262884935","details":"In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-262884935","CVE-2026-28597"],"modified":"2026-11-02T17:11:14.491071857Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298","target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["49714436608044671305293876268688011751","27235926812117504666227503456781838858","152131684056357529303359116694599025110","192237261357507002612339171188052603944","140495636727712672716440343884166268756","157719352045282315778688066858686201191","107884727821770368367347544731045814570","89816167525425443615835220578845872850"]},"id":"ASB-A-262884935-1cded88a","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/643b15430b92b743d69ab9d873dc206c213f3b26","target":{"function":"writeGrantedUriPermissionWithSnapshot","file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"},"deprecated":false,"digest":{"function_hash":"96375408898447538659536913358771750766","length":1656},"id":"ASB-A-262884935-3660e61e","match_only_versions":["17-qpr2-next"]},{"deprecated":false,"digest":{"line_hashes":["208066064267241960959440941019057948997","313737864995091110429460964588625254278","14117458227292577305935911113212513881","238051827951220167354838224651315039593","188418041337602474075491705044948425522","271409270120930447055350760298209320538","127777762670012129513346807589712012754","77828897691903140610541870309814868835","124206579015600549164449103829268990919","173509816950935623162542703793514283472","276836399207426780002331109902106526021","260997651908002305298770814439457104666","167984905105034397083832491026409320181","113223502937592717980155175581986064747","25551873650588914003464304440811981086","10360057136569032732299731456835186082","223611691733174629427932502533012916570","46989173182728006183241236139019195354","137577992719925689576038138992345831392","245096642054775315075274008460296428961","263901127997092598003410834345461647047"],"threshold":0.9},"id":"ASB-A-262884935-b1bd5c19","match_only_versions":["17-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/643b15430b92b743d69ab9d873dc206c213f3b26","target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298","target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["58670020022276940087647970307836601199","315148219331921030566269997373448571861","192086011035144630534812329229620258818","260287082417008909222784211034295258968","265790801120572393218953429802584020240","70653557675873499691925765785249816034","194811434092391301974013545190413141185","33150181908758360640020837957982183397","312895007790225659854354312298784159199","108408552910146826053673955449778310358","137696438128835532204806381809806166686","80797616084554163508356591809675752271","52950164070929098033575560126105451061","191019419916906064687848028646737864967","208333260615160174296918704248449711573","120723792442756082647344117031437317838","196131753133668671130504834467997254354","83127344736328599676001642467244968833","104119711074550133945869178538437504971","224275535601845120267244912199302071890","240785075554445538493757802638685194054","188146902918788390764632983646377252055","142361514505696748380105095567532808199","123664273482389585516345188777816474886","397119352004599082162725205329512310","135765611353314023128529939795503747805","207213090650747517810620129618804091220","271911949780274440842928288276957635384"]},"id":"ASB-A-262884935-c3678b7b","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298","target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java","function":"writeGrantedUriPermissions"},"deprecated":false,"digest":{"length":1673,"function_hash":"275695760622047620742569185681751300143"},"id":"ASB-A-262884935-faa8f7a9","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298","https://android.googlesource.com/platform/frameworks/base/+/643b15430b92b743d69ab9d873dc206c213f3b26"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370","target":{"function":"writeGrantedUriPermissions","file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"},"deprecated":false,"digest":{"length":1673,"function_hash":"275695760622047620742569185681751300143"},"id":"ASB-A-262884935-9eccac08","signature_type":"Function"},{"target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"},"deprecated":false,"digest":{"line_hashes":["290186854208823290511265801338864998030","286340809122951368854389731249383566301","53154135960009604216752095956444432126","140495636727712672716440343884166268756","157719352045282315778688066858686201191","107884727821770368367347544731045814570","89816167525425443615835220578845872850"],"threshold":0.9},"id":"ASB-A-262884935-c2e3e075","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370"},{"target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"},"deprecated":false,"digest":{"line_hashes":["58670020022276940087647970307836601199","315148219331921030566269997373448571861","192086011035144630534812329229620258818","260287082417008909222784211034295258968","265790801120572393218953429802584020240","70653557675873499691925765785249816034","194811434092391301974013545190413141185","120723792442756082647344117031437317838","196131753133668671130504834467997254354","83127344736328599676001642467244968833","104119711074550133945869178538437504971","224275535601845120267244912199302071890","240785075554445538493757802638685194054","188146902918788390764632983646377252055","142361514505696748380105095567532808199","123664273482389585516345188777816474886","397119352004599082162725205329512310","135765611353314023128529939795503747805","207213090650747517810620129618804091220","271911949780274440842928288276957635384"],"threshold":0.9},"id":"ASB-A-262884935-f25b13ba","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e","target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["49714436608044671305293876268688011751","27235926812117504666227503456781838858","152131684056357529303359116694599025110","192237261357507002612339171188052603944","140495636727712672716440343884166268756","157719352045282315778688066858686201191","107884727821770368367347544731045814570","89816167525425443615835220578845872850"]},"id":"ASB-A-262884935-27d38d64"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e","target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java","function":"writeGrantedUriPermissions"},"deprecated":false,"digest":{"length":1673,"function_hash":"275695760622047620742569185681751300143"},"id":"ASB-A-262884935-82a01014","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["58670020022276940087647970307836601199","315148219331921030566269997373448571861","192086011035144630534812329229620258818","260287082417008909222784211034295258968","265790801120572393218953429802584020240","70653557675873499691925765785249816034","194811434092391301974013545190413141185","120723792442756082647344117031437317838","196131753133668671130504834467997254354","83127344736328599676001642467244968833","104119711074550133945869178538437504971","224275535601845120267244912199302071890","240785075554445538493757802638685194054","188146902918788390764632983646377252055","142361514505696748380105095567532808199","123664273482389585516345188777816474886","397119352004599082162725205329512310","135765611353314023128529939795503747805","207213090650747517810620129618804091220","271911949780274440842928288276957635384"],"threshold":0.9},"id":"ASB-A-262884935-a2f61b5e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e","target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-262884935-17c98f6e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d","target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"},"deprecated":false,"digest":{"line_hashes":["58670020022276940087647970307836601199","315148219331921030566269997373448571861","192086011035144630534812329229620258818","260287082417008909222784211034295258968","265790801120572393218953429802584020240","70653557675873499691925765785249816034","194811434092391301974013545190413141185","120723792442756082647344117031437317838","196131753133668671130504834467997254354","83127344736328599676001642467244968833","104119711074550133945869178538437504971","224275535601845120267244912199302071890","240785075554445538493757802638685194054","188146902918788390764632983646377252055","142361514505696748380105095567532808199","123664273482389585516345188777816474886","397119352004599082162725205329512310","135765611353314023128529939795503747805","207213090650747517810620129618804091220","271911949780274440842928288276957635384"],"threshold":0.9}},{"target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java","function":"writeGrantedUriPermissions"},"deprecated":false,"digest":{"length":1673,"function_hash":"275695760622047620742569185681751300143"},"id":"ASB-A-262884935-1d4688c8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d"},{"deprecated":false,"digest":{"line_hashes":["49714436608044671305293876268688011751","27235926812117504666227503456781838858","152131684056357529303359116694599025110","192237261357507002612339171188052603944","140495636727712672716440343884166268756","157719352045282315778688066858686201191","107884727821770368367347544731045814570","89816167525425443615835220578845872850"],"threshold":0.9},"id":"ASB-A-262884935-6a7ea539","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d","target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-262884935-6bdd18fc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c","target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["58670020022276940087647970307836601199","315148219331921030566269997373448571861","192086011035144630534812329229620258818","260287082417008909222784211034295258968","265790801120572393218953429802584020240","70653557675873499691925765785249816034","194811434092391301974013545190413141185","120723792442756082647344117031437317838","196131753133668671130504834467997254354","83127344736328599676001642467244968833","104119711074550133945869178538437504971","224275535601845120267244912199302071890","240785075554445538493757802638685194054","188146902918788390764632983646377252055","142361514505696748380105095567532808199","123664273482389585516345188777816474886","397119352004599082162725205329512310","135765611353314023128529939795503747805","207213090650747517810620129618804091220","271911949780274440842928288276957635384"]}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c","target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java","function":"writeGrantedUriPermissions"},"deprecated":false,"digest":{"length":1673,"function_hash":"275695760622047620742569185681751300143"},"id":"ASB-A-262884935-886f39f9","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["290186854208823290511265801338864998030","286340809122951368854389731249383566301","53154135960009604216752095956444432126","140495636727712672716440343884166268756","157719352045282315778688066858686201191","107884727821770368367347544731045814570","89816167525425443615835220578845872850"],"threshold":0.9},"id":"ASB-A-262884935-8faa9805","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c","target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-262884935.json"}}],"schema_version":"1.9.2"}