{"id":"ASB-A-388272624","details":"In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-388272624","CVE-2026-28593"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-05"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"length":4255,"function_hash":"70043451388105557956725064573787928714"},"id":"ASB-A-388272624-541cb2af","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/22867ae71e25bb43cfd2d3640a6abf7ee206cc7f","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"getItemList"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/22867ae71e25bb43cfd2d3640a6abf7ee206cc7f","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"]},"id":"ASB-A-388272624-58eecc86","signature_type":"Line","signature_version":"v1"},{"target":{"function":"onSelected","file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-c56c175c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/22867ae71e25bb43cfd2d3640a6abf7ee206cc7f"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/22867ae71e25bb43cfd2d3640a6abf7ee206cc7f"],"severity":"High","spl":"2026-09-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-05"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/6690b3faa83ac5310fd74e908dc73d4a20cdc8b5"],"severity":"High","spl":"2026-09-05","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6690b3faa83ac5310fd74e908dc73d4a20cdc8b5","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"],"threshold":0.9},"id":"ASB-A-388272624-0ba6ebb0"},{"target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"onSelected"},"deprecated":false,"digest":{"length":318,"function_hash":"230325271482966545914798151431230258124"},"id":"ASB-A-388272624-30d9b576","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6690b3faa83ac5310fd74e908dc73d4a20cdc8b5"},{"target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"getItemList"},"deprecated":false,"digest":{"length":4255,"function_hash":"70043451388105557956725064573787928714"},"id":"ASB-A-388272624-bd93c5ff","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6690b3faa83ac5310fd74e908dc73d4a20cdc8b5"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-05"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/6a1362ac8e81a735fd149c879da43eb878e4c734"],"severity":"High","spl":"2026-09-05","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6a1362ac8e81a735fd149c879da43eb878e4c734","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"getItemList"},"deprecated":false,"digest":{"length":4255,"function_hash":"70043451388105557956725064573787928714"},"id":"ASB-A-388272624-8f1d6a29"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6a1362ac8e81a735fd149c879da43eb878e4c734","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"onSelected"},"deprecated":false,"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-a39439f2"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6a1362ac8e81a735fd149c879da43eb878e4c734","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"],"threshold":0.9},"id":"ASB-A-388272624-c2ccf76d"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-05"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-05","types":["EoP"],"vanir_signatures":[{"target":{"function":"getItemList","file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"function_hash":"70043451388105557956725064573787928714","length":4255},"id":"ASB-A-388272624-1bef4135","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/2b171784da320edf78e7a33adae5c20cf522047f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/2b171784da320edf78e7a33adae5c20cf522047f","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"]},"id":"ASB-A-388272624-6ebfc21d","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/2b171784da320edf78e7a33adae5c20cf522047f","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"onSelected"},"deprecated":false,"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-71a1933f","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/2b171784da320edf78e7a33adae5c20cf522047f"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-05"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-388272624-88898e96","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/b4a1f66f6edfd51baaa5673e0eacab2b43bbe22e","target":{"function":"getItemList","file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"function_hash":"70043451388105557956725064573787928714","length":4255}},{"id":"ASB-A-388272624-92bce16f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/b4a1f66f6edfd51baaa5673e0eacab2b43bbe22e","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/b4a1f66f6edfd51baaa5673e0eacab2b43bbe22e","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"onSelected"},"deprecated":false,"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-cc7b0fdb","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/b4a1f66f6edfd51baaa5673e0eacab2b43bbe22e"],"severity":"High","spl":"2026-09-05","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-05"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"]},"id":"ASB-A-388272624-6f3dc0ff","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/423440619432f73088e748d37cabbfb0384e9326","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"}},{"target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"onSelected"},"deprecated":false,"digest":{"length":318,"function_hash":"230325271482966545914798151431230258124"},"id":"ASB-A-388272624-850221c7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/423440619432f73088e748d37cabbfb0384e9326"},{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/423440619432f73088e748d37cabbfb0384e9326","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"getItemList"},"deprecated":false,"digest":{"function_hash":"70043451388105557956725064573787928714","length":4255},"id":"ASB-A-388272624-a7a3c909","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/423440619432f73088e748d37cabbfb0384e9326"],"severity":"High","spl":"2026-09-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}}],"schema_version":"1.9.0"}