{"id":"ASB-A-397217317","details":"In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-397217317","CVE-2026-0098"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"}],"affected":[{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":88,"function_hash":"38673750997274407261682880125275058068"},"id":"ASB-A-397217317-2dfda822","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"isSystemApp"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f","target":{"file":"src/com/android/documentsui/base/Shared.java"},"deprecated":false,"digest":{"line_hashes":["161956108484107881812162884493901490715","193326091447123318753589310785420373853","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","80901011836666089040166712009679233920"],"threshold":0.9},"id":"ASB-A-397217317-5c2726bd","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"getCallingPackageName"},"deprecated":false,"digest":{"function_hash":"219849726313033047941582013681064357104","length":387},"id":"ASB-A-397217317-e04a4408","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"80612551930596608646497750952715777009","length":100},"id":"ASB-A-397217317-f96c1173","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"isUpdatedSystemApp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f"],"severity":"High","spl":"2026-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360"],"severity":"High","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["48824242202000771007508310945523377584","325498635662759965840201795406878624040","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","225841640417887430115579563027318368521"],"threshold":0.9},"id":"ASB-A-397217317-4c30e20b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360","target":{"file":"src/com/android/documentsui/base/Shared.java"}},{"digest":{"function_hash":"80612551930596608646497750952715777009","length":100},"id":"ASB-A-397217317-9570db9e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360","target":{"function":"isUpdatedSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"deprecated":false},{"target":{"file":"src/com/android/documentsui/base/Shared.java","function":"isSystemApp"},"deprecated":false,"digest":{"function_hash":"38673750997274407261682880125275058068","length":88},"id":"ASB-A-397217317-b9d43048","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360"},{"digest":{"function_hash":"219849726313033047941582013681064357104","length":387},"id":"ASB-A-397217317-fc0927cc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"getCallingPackageName"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["48824242202000771007508310945523377584","325498635662759965840201795406878624040","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","225841640417887430115579563027318368521"],"threshold":0.9},"id":"ASB-A-397217317-0ef81ce8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2","target":{"file":"src/com/android/documentsui/base/Shared.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"getCallingPackageName"},"deprecated":false,"digest":{"function_hash":"219849726313033047941582013681064357104","length":387},"id":"ASB-A-397217317-19030f1f","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"isUpdatedSystemApp"},"deprecated":false,"digest":{"function_hash":"80612551930596608646497750952715777009","length":100},"id":"ASB-A-397217317-da490c51"},{"id":"ASB-A-397217317-e38ea371","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"isSystemApp"},"deprecated":false,"digest":{"length":88,"function_hash":"38673750997274407261682880125275058068"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2"],"severity":"High","spl":"2026-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-397217317-23919003","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"getCallingPackageName"},"deprecated":false,"digest":{"function_hash":"219849726313033047941582013681064357104","length":387}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc","target":{"file":"src/com/android/documentsui/base/Shared.java"},"deprecated":false,"digest":{"line_hashes":["48824242202000771007508310945523377584","325498635662759965840201795406878624040","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","80901011836666089040166712009679233920"],"threshold":0.9},"id":"ASB-A-397217317-7c99c3f1"},{"deprecated":false,"digest":{"function_hash":"38673750997274407261682880125275058068","length":88},"id":"ASB-A-397217317-d40a1e98","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"isSystemApp"}},{"deprecated":false,"digest":{"length":100,"function_hash":"80612551930596608646497750952715777009"},"id":"ASB-A-397217317-ee5026ea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"isUpdatedSystemApp"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"219849726313033047941582013681064357104","length":387},"id":"ASB-A-397217317-0b6f76df","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"getCallingPackageName"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["48824242202000771007508310945523377584","325498635662759965840201795406878624040","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","225841640417887430115579563027318368521"],"threshold":0.9},"id":"ASB-A-397217317-32ac511a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99","target":{"file":"src/com/android/documentsui/base/Shared.java"}},{"id":"ASB-A-397217317-524ec4d2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99","target":{"file":"src/com/android/documentsui/base/Shared.java","function":"isUpdatedSystemApp"},"deprecated":false,"digest":{"length":100,"function_hash":"80612551930596608646497750952715777009"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99","target":{"function":"isSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"deprecated":false,"digest":{"length":88,"function_hash":"38673750997274407261682880125275058068"},"id":"ASB-A-397217317-c61ae8fb"}],"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}}],"schema_version":"1.9.0"}