{"id":"ASB-A-349318333","details":"In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-349318333","CVE-2026-58836"],"modified":"2026-11-02T17:11:21.240953952Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/c06b539f3109383224362ce9ab567a4c78c383e1","target":{"function":"handlePackagePostInstall","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"length":3824,"function_hash":"96552639340851458938414067618559339265"},"id":"ASB-A-349318333-40b7f871","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c06b539f3109383224362ce9ab567a4c78c383e1","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"line_hashes":["225655952136627345140544747043371473420","181643256137594243119830058869882159526","201339850563738457002402554786183575808","339557525162858247196771881320633270088","28928597375337600204222332327275969644","107115069225965149447871763730278748069","219982860852155744088814255327918757439","106559757152006970295611668040062029025","128304521799675867583940051458682298493","250557203788059399280682980473833803638","266987544006947530092500999493404866486","102332067067627989104450103423287840146","101986957911186362569484053996623160600","244125084856819352952595829882912148068","106693184872776943290393094224511021665"],"threshold":0.9},"id":"ASB-A-349318333-ed232568"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c06b539f3109383224362ce9ab567a4c78c383e1"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-349318333.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"63388427733452695298063355201745534812","length":4015},"id":"ASB-A-349318333-b8903094","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/30083b50c1f18bf617459e5415da03a29366ea60","target":{"function":"handlePackagePostInstall","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/30083b50c1f18bf617459e5415da03a29366ea60","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"line_hashes":["225655952136627345140544747043371473420","181643256137594243119830058869882159526","201339850563738457002402554786183575808","339557525162858247196771881320633270088","28928597375337600204222332327275969644","107115069225965149447871763730278748069","219982860852155744088814255327918757439","106559757152006970295611668040062029025","128304521799675867583940051458682298493","250557203788059399280682980473833803638","266987544006947530092500999493404866486","102332067067627989104450103423287840146","101986957911186362569484053996623160600","244125084856819352952595829882912148068","106693184872776943290393094224511021665"],"threshold":0.9},"id":"ASB-A-349318333-e428107b","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/30083b50c1f18bf617459e5415da03a29366ea60"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-349318333.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a3a6a181f9a634c937e52ef39c181277a1e0f790"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3a6a181f9a634c937e52ef39c181277a1e0f790","target":{"function":"handlePackagePostInstall","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"length":3782,"function_hash":"185064879593035324171915782227754279035"},"id":"ASB-A-349318333-15531f20"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3a6a181f9a634c937e52ef39c181277a1e0f790","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"line_hashes":["225655952136627345140544747043371473420","181643256137594243119830058869882159526","201339850563738457002402554786183575808","339557525162858247196771881320633270088","28928597375337600204222332327275969644","107115069225965149447871763730278748069","219982860852155744088814255327918757439","106559757152006970295611668040062029025","128304521799675867583940051458682298493","250557203788059399280682980473833803638","266987544006947530092500999493404866486","102332067067627989104450103423287840146","101986957911186362569484053996623160600","244125084856819352952595829882912148068","106693184872776943290393094224511021665"],"threshold":0.9},"id":"ASB-A-349318333-d4b8d4ef","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-349318333.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/00822bb857ac91e09b10169a9babc075e94a1d3a","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["225655952136627345140544747043371473420","181643256137594243119830058869882159526","201339850563738457002402554786183575808","339557525162858247196771881320633270088","28928597375337600204222332327275969644","107115069225965149447871763730278748069","219982860852155744088814255327918757439","106559757152006970295611668040062029025","128304521799675867583940051458682298493","250557203788059399280682980473833803638","266987544006947530092500999493404866486","102332067067627989104450103423287840146","101986957911186362569484053996623160600","244125084856819352952595829882912148068","106693184872776943290393094224511021665"]},"id":"ASB-A-349318333-9f38084b","signature_type":"Line"},{"id":"ASB-A-349318333-cc53fcde","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/00822bb857ac91e09b10169a9babc075e94a1d3a","target":{"function":"handlePackagePostInstall","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"function_hash":"96552639340851458938414067618559339265","length":3824}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/00822bb857ac91e09b10169a9babc075e94a1d3a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-349318333.json"}}],"schema_version":"1.9.2"}