{"id":"ASB-A-332883816","details":"In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-332883816","CVE-2026-28626"],"modified":"2026-09-08T15:39:03.104189951Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-05"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["71942208783563358557226580270672865735","169678827038952158752333276100582581248","37418170836468364298968539675364713501","134130750238688401524396069194677068073","249394292296510464685928265344639227432","250448781764467318139100859754884135545","224707963004023311107968495427054364213","3300911386987079652467214465728029902"],"threshold":0.9},"id":"ASB-A-332883816-042165b2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/419fb3da8c29f17bb2d8681d48853fe481baf0ba","target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/419fb3da8c29f17bb2d8681d48853fe481baf0ba","target":{"file":"src/com/android/tv/SetupPassthroughActivity.java","function":"onCreate"},"deprecated":false,"digest":{"length":2263,"function_hash":"258747669667375970880117225168403337790"},"id":"ASB-A-332883816-7ac45665","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/419fb3da8c29f17bb2d8681d48853fe481baf0ba"],"severity":"High","spl":"2026-09-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-332883816.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-05"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/ef6ea1d1f326f7ba4c4c8c5f3a4c5c1f9ff22965","target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"},"deprecated":false,"digest":{"line_hashes":["71942208783563358557226580270672865735","169678827038952158752333276100582581248","37418170836468364298968539675364713501","134130750238688401524396069194677068073","249394292296510464685928265344639227432","250448781764467318139100859754884135545","224707963004023311107968495427054364213","3300911386987079652467214465728029902"],"threshold":0.9},"id":"ASB-A-332883816-1c047a0b","signature_type":"Line"},{"target":{"function":"onCreate","file":"src/com/android/tv/SetupPassthroughActivity.java"},"deprecated":false,"digest":{"length":2263,"function_hash":"258747669667375970880117225168403337790"},"id":"ASB-A-332883816-ec79d540","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/ef6ea1d1f326f7ba4c4c8c5f3a4c5c1f9ff22965"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/ef6ea1d1f326f7ba4c4c8c5f3a4c5c1f9ff22965"],"severity":"High","spl":"2026-09-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-332883816.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-05"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"},"deprecated":false,"digest":{"line_hashes":["71942208783563358557226580270672865735","169678827038952158752333276100582581248","37418170836468364298968539675364713501","134130750238688401524396069194677068073","249394292296510464685928265344639227432","250448781764467318139100859754884135545","224707963004023311107968495427054364213","3300911386987079652467214465728029902"],"threshold":0.9},"id":"ASB-A-332883816-4abc9819","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/949f733401724eef85d181a3605201da5d03bd6a"},{"target":{"file":"src/com/android/tv/SetupPassthroughActivity.java","function":"onCreate"},"deprecated":false,"digest":{"length":2263,"function_hash":"258747669667375970880117225168403337790"},"id":"ASB-A-332883816-6496b805","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/949f733401724eef85d181a3605201da5d03bd6a"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/949f733401724eef85d181a3605201da5d03bd6a"],"severity":"High","spl":"2026-09-05","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-332883816.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-05"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/1778d44a2bad56a1ea19d21150dd458bb4aaa261"],"severity":"High","spl":"2026-09-05","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["71942208783563358557226580270672865735","169678827038952158752333276100582581248","37418170836468364298968539675364713501","134130750238688401524396069194677068073","249394292296510464685928265344639227432","250448781764467318139100859754884135545","224707963004023311107968495427054364213","3300911386987079652467214465728029902"],"threshold":0.9},"id":"ASB-A-332883816-5228816f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/1778d44a2bad56a1ea19d21150dd458bb4aaa261","target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/1778d44a2bad56a1ea19d21150dd458bb4aaa261","target":{"file":"src/com/android/tv/SetupPassthroughActivity.java","function":"onCreate"},"deprecated":false,"digest":{"length":2263,"function_hash":"258747669667375970880117225168403337790"},"id":"ASB-A-332883816-555ce36d"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-332883816.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-05"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["71942208783563358557226580270672865735","169678827038952158752333276100582581248","37418170836468364298968539675364713501","134130750238688401524396069194677068073","249394292296510464685928265344639227432","250448781764467318139100859754884135545","224707963004023311107968495427054364213","3300911386987079652467214465728029902"],"threshold":0.9},"id":"ASB-A-332883816-4b276de5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/5fe9d0c8b19fd0d515dcff8204bffb1c18b24286","target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"}},{"target":{"file":"src/com/android/tv/SetupPassthroughActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"258747669667375970880117225168403337790","length":2263},"id":"ASB-A-332883816-520cdce3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/5fe9d0c8b19fd0d515dcff8204bffb1c18b24286"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/5fe9d0c8b19fd0d515dcff8204bffb1c18b24286"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-332883816.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-05"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/513248f88c781c14591f357d1f9bdd998a961751","target":{"file":"src/com/android/tv/SetupPassthroughActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"258747669667375970880117225168403337790","length":2263},"id":"ASB-A-332883816-e2100705"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/513248f88c781c14591f357d1f9bdd998a961751","target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"},"deprecated":false,"digest":{"line_hashes":["71942208783563358557226580270672865735","169678827038952158752333276100582581248","37418170836468364298968539675364713501","134130750238688401524396069194677068073","249394292296510464685928265344639227432","250448781764467318139100859754884135545","224707963004023311107968495427054364213","3300911386987079652467214465728029902"],"threshold":0.9},"id":"ASB-A-332883816-fa6325fc"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/513248f88c781c14591f357d1f9bdd998a961751"],"severity":"High","spl":"2026-09-05","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-332883816.json"}}],"schema_version":"1.9.0"}