{"id":"ASB-A-329233015","details":"In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-329233015","CVE-2026-28613"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/tv/data/ChannelImpl.java"},"deprecated":false,"digest":{"line_hashes":["125903331997634824313909372045928403101","331113026861862374895474285209768846213","338327705831313875220268959582057108590","11809828591642118921488302570555839644","187140409983236949167563400933486793273","224521677386353263215494778810229768251","280341753752157569741377043583314714858","212711621034491089131739578336956106022","178991285254059016134939756305430537558"],"threshold":0.9},"id":"ASB-A-329233015-e06ad465","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/415d636eb465a20ddcdd12244e675cdf18971f7b"},{"id":"ASB-A-329233015-fc4eea82","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/415d636eb465a20ddcdd12244e675cdf18971f7b","target":{"file":"src/com/android/tv/data/ChannelImpl.java","function":"initAppLinkTypeAndIntent"},"deprecated":false,"digest":{"function_hash":"196249853139039549830237051170712129000","length":1363}}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/415d636eb465a20ddcdd12244e675cdf18971f7b"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/2a006313f82e6339b71fb3f7090c40d44bf28d2f","target":{"file":"src/com/android/tv/data/ChannelImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["125903331997634824313909372045928403101","331113026861862374895474285209768846213","338327705831313875220268959582057108590","11809828591642118921488302570555839644","187140409983236949167563400933486793273","224521677386353263215494778810229768251","280341753752157569741377043583314714858","212711621034491089131739578336956106022","178991285254059016134939756305430537558"]},"id":"ASB-A-329233015-35876192","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"196249853139039549830237051170712129000","length":1363},"id":"ASB-A-329233015-e0758b38","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/2a006313f82e6339b71fb3f7090c40d44bf28d2f","target":{"function":"initAppLinkTypeAndIntent","file":"src/com/android/tv/data/ChannelImpl.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/2a006313f82e6339b71fb3f7090c40d44bf28d2f"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/a0ee38f7a4f4560fbb9b69b53ff02318eaeb645a","target":{"file":"src/com/android/tv/data/ChannelImpl.java"},"deprecated":false,"digest":{"line_hashes":["125903331997634824313909372045928403101","331113026861862374895474285209768846213","338327705831313875220268959582057108590","11809828591642118921488302570555839644","187140409983236949167563400933486793273","224521677386353263215494778810229768251","280341753752157569741377043583314714858","212711621034491089131739578336956106022","178991285254059016134939756305430537558"],"threshold":0.9},"id":"ASB-A-329233015-82f42b71","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/a0ee38f7a4f4560fbb9b69b53ff02318eaeb645a","target":{"file":"src/com/android/tv/data/ChannelImpl.java","function":"initAppLinkTypeAndIntent"},"deprecated":false,"digest":{"length":1363,"function_hash":"196249853139039549830237051170712129000"},"id":"ASB-A-329233015-d829e703","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/a0ee38f7a4f4560fbb9b69b53ff02318eaeb645a"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/3cd46ba2b7d4da6ed42fba704bd043e0775e6b20","target":{"file":"src/com/android/tv/data/ChannelImpl.java","function":"initAppLinkTypeAndIntent"},"deprecated":false,"digest":{"function_hash":"196249853139039549830237051170712129000","length":1363},"id":"ASB-A-329233015-7cfd7b59"},{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/3cd46ba2b7d4da6ed42fba704bd043e0775e6b20","target":{"file":"src/com/android/tv/data/ChannelImpl.java"},"deprecated":false,"digest":{"line_hashes":["125903331997634824313909372045928403101","331113026861862374895474285209768846213","338327705831313875220268959582057108590","11809828591642118921488302570555839644","187140409983236949167563400933486793273","224521677386353263215494778810229768251","280341753752157569741377043583314714858","212711621034491089131739578336956106022","178991285254059016134939756305430537558"],"threshold":0.9},"id":"ASB-A-329233015-c77ffae1","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/3cd46ba2b7d4da6ed42fba704bd043e0775e6b20"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/18b8cdfa88c81d5304a4697733c3c639bc480727","target":{"function":"initAppLinkTypeAndIntent","file":"src/com/android/tv/data/ChannelImpl.java"},"deprecated":false,"digest":{"function_hash":"196249853139039549830237051170712129000","length":1363},"id":"ASB-A-329233015-e395d564","signature_type":"Function"},{"id":"ASB-A-329233015-e938062e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/18b8cdfa88c81d5304a4697733c3c639bc480727","target":{"file":"src/com/android/tv/data/ChannelImpl.java"},"deprecated":false,"digest":{"line_hashes":["125903331997634824313909372045928403101","331113026861862374895474285209768846213","338327705831313875220268959582057108590","11809828591642118921488302570555839644","187140409983236949167563400933486793273","224521677386353263215494778810229768251","280341753752157569741377043583314714858","212711621034491089131739578336956106022","178991285254059016134939756305430537558"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/18b8cdfa88c81d5304a4697733c3c639bc480727"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["125903331997634824313909372045928403101","331113026861862374895474285209768846213","338327705831313875220268959582057108590","11809828591642118921488302570555839644","187140409983236949167563400933486793273","224521677386353263215494778810229768251","280341753752157569741377043583314714858","212711621034491089131739578336956106022","178991285254059016134939756305430537558"],"threshold":0.9},"id":"ASB-A-329233015-194518ee","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/7648d0a746a191612c97ac9c581c1ebc3b13fa2a","target":{"file":"src/com/android/tv/data/ChannelImpl.java"}},{"target":{"file":"src/com/android/tv/data/ChannelImpl.java","function":"initAppLinkTypeAndIntent"},"deprecated":false,"digest":{"length":1363,"function_hash":"196249853139039549830237051170712129000"},"id":"ASB-A-329233015-4c5db74f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/7648d0a746a191612c97ac9c581c1ebc3b13fa2a"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/7648d0a746a191612c97ac9c581c1ebc3b13fa2a"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-329233015.json"}}],"schema_version":"1.9.0"}