{"id":"ASB-A-388272624","details":"In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-388272624","CVE-2026-28593"],"modified":"2026-10-29T15:51:35.830487715Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/TV/+/724154d5db034439eeb911fcf419030094407c4f"}],"affected":[{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-05"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/22867ae71e25bb43cfd2d3640a6abf7ee206cc7f","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"getItemList"},"deprecated":false,"digest":{"length":4255,"function_hash":"70043451388105557956725064573787928714"},"id":"ASB-A-388272624-541cb2af"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"]},"id":"ASB-A-388272624-58eecc86","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/22867ae71e25bb43cfd2d3640a6abf7ee206cc7f","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/22867ae71e25bb43cfd2d3640a6abf7ee206cc7f","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"onSelected"},"deprecated":false,"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-c56c175c"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/22867ae71e25bb43cfd2d3640a6abf7ee206cc7f"],"severity":"High","spl":"2026-09-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-05"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-09-05","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6690b3faa83ac5310fd74e908dc73d4a20cdc8b5","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"]},"id":"ASB-A-388272624-0ba6ebb0"},{"target":{"function":"onSelected","file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-30d9b576","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6690b3faa83ac5310fd74e908dc73d4a20cdc8b5"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6690b3faa83ac5310fd74e908dc73d4a20cdc8b5","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"getItemList"},"deprecated":false,"digest":{"function_hash":"70043451388105557956725064573787928714","length":4255},"id":"ASB-A-388272624-bd93c5ff"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/6690b3faa83ac5310fd74e908dc73d4a20cdc8b5"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-05"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"target":{"function":"getItemList","file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"length":4255,"function_hash":"70043451388105557956725064573787928714"},"id":"ASB-A-388272624-8f1d6a29","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6a1362ac8e81a735fd149c879da43eb878e4c734"},{"deprecated":false,"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-a39439f2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6a1362ac8e81a735fd149c879da43eb878e4c734","target":{"function":"onSelected","file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/6a1362ac8e81a735fd149c879da43eb878e4c734","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"],"threshold":0.9},"id":"ASB-A-388272624-c2ccf76d","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/6a1362ac8e81a735fd149c879da43eb878e4c734"],"severity":"High","spl":"2026-09-05","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-05"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/2b171784da320edf78e7a33adae5c20cf522047f"],"severity":"High","spl":"2026-09-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"70043451388105557956725064573787928714","length":4255},"id":"ASB-A-388272624-1bef4135","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/2b171784da320edf78e7a33adae5c20cf522047f","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"getItemList"}},{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/2b171784da320edf78e7a33adae5c20cf522047f","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false,"digest":{"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"],"threshold":0.9},"id":"ASB-A-388272624-6ebfc21d","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-71a1933f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/2b171784da320edf78e7a33adae5c20cf522047f","target":{"function":"onSelected","file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-05"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-05","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/TV/+/b4a1f66f6edfd51baaa5673e0eacab2b43bbe22e","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"getItemList"},"deprecated":false,"digest":{"function_hash":"70043451388105557956725064573787928714","length":4255},"id":"ASB-A-388272624-88898e96","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"],"threshold":0.9},"id":"ASB-A-388272624-92bce16f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/b4a1f66f6edfd51baaa5673e0eacab2b43bbe22e","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"},"deprecated":false},{"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-cc7b0fdb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/b4a1f66f6edfd51baaa5673e0eacab2b43bbe22e","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"onSelected"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/b4a1f66f6edfd51baaa5673e0eacab2b43bbe22e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}},{"package":{"name":"platform/packages/apps/TV","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-05"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["131621384942929543238263174442091992093","311347417055813189085412106722562494214","277295239211008796884666792817373009444","323386657629912654993495215722778683368","288569052919082875114760740350600521032","172721774946857337335535562320374059463","122404387189620531142901346830170886917","175087047309699577899250417148153313887","77276597093751887925888833701697511521","50513344625086022015196611563496216870"],"threshold":0.9},"id":"ASB-A-388272624-6f3dc0ff","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/423440619432f73088e748d37cabbfb0384e9326","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java"}},{"digest":{"function_hash":"230325271482966545914798151431230258124","length":318},"id":"ASB-A-388272624-850221c7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/423440619432f73088e748d37cabbfb0384e9326","target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"onSelected"},"deprecated":false},{"target":{"file":"src/com/android/tv/ui/sidepanel/SettingsFragment.java","function":"getItemList"},"deprecated":false,"digest":{"function_hash":"70043451388105557956725064573787928714","length":4255},"id":"ASB-A-388272624-a7a3c909","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/TV/+/423440619432f73088e748d37cabbfb0384e9326"}],"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/423440619432f73088e748d37cabbfb0384e9326"],"severity":"High","spl":"2026-09-05"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388272624.json"}}],"schema_version":"1.9.2"}