{"id":"ASB-A-321711213","details":"In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission  due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-321711213","CVE-2026-0026"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"match_only_versions":["16-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0ead58f69f5de82b00406316b333366d556239f1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java","function":"removePermission"},"deprecated":false,"digest":{"function_hash":"32121542012993099560012439381062572158","length":561},"id":"ASB-A-321711213-22a2bd3b"},{"deprecated":false,"digest":{"line_hashes":["205992449486788654372145536191581528691","84920920381514802046653589203483262959","39433141656619788838867682029677786107","28484308096576128347231381074450762061"],"threshold":0.9},"id":"ASB-A-321711213-5b9671e4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java"}},{"match_only_versions":["16-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0ead58f69f5de82b00406316b333366d556239f1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["249589022416497462940867915054438733893","232722225026488737429026988457105817530","205992449486788654372145536191581528691","181461015334851422260102675675321030541"]},"id":"ASB-A-321711213-f43825dc"},{"id":"ASB-A-321711213-f66d1d99","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java","function":"removePermission"},"deprecated":false,"digest":{"length":552,"function_hash":"175097904346831881255429111086632473640"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","https://android.googlesource.com/platform/frameworks/base/+/0ead58f69f5de82b00406316b333366d556239f1"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-321711213.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["205992449486788654372145536191581528691","84920920381514802046653589203483262959","39433141656619788838867682029677786107","28484308096576128347231381074450762061"]},"id":"ASB-A-321711213-8d35ec89","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-321711213-ce172bf6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1","target":{"file":"services/core/java/com/android/server/pm/permission/PermissionManagerServiceImpl.java","function":"removePermission"},"deprecated":false,"digest":{"function_hash":"175097904346831881255429111086632473640","length":552}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/528a87e90ff9354581d54fd37fbe9f95cccbcdb1"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-321711213.json"}}],"schema_version":"1.9.0"}