{"id":"ASB-A-397217317","details":"In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-397217317","CVE-2026-0098"],"modified":"2026-07-09T15:25:53.339171538Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"}],"affected":[{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f"],"vanir_signatures":[{"digest":{"function_hash":"38673750997274407261682880125275058068","length":88},"signature_type":"Function","id":"ASB-A-397217317-2dfda822","deprecated":false,"target":{"function":"isSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f","signature_version":"v1"},{"target":{"file":"src/com/android/documentsui/base/Shared.java"},"signature_type":"Line","id":"ASB-A-397217317-5c2726bd","signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f","digest":{"line_hashes":["161956108484107881812162884493901490715","193326091447123318753589310785420373853","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","80901011836666089040166712009679233920"],"threshold":0.9}},{"digest":{"function_hash":"219849726313033047941582013681064357104","length":387},"signature_type":"Function","id":"ASB-A-397217317-e04a4408","deprecated":false,"target":{"function":"getCallingPackageName","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f","signature_version":"v1"},{"digest":{"function_hash":"80612551930596608646497750952715777009","length":100},"signature_type":"Function","id":"ASB-A-397217317-f96c1173","deprecated":false,"target":{"function":"isUpdatedSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/006c7c2f5ec255a8515c7ec146a08ea60bdc720f","signature_version":"v1"}],"types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360"],"vanir_signatures":[{"signature_version":"v1","signature_type":"Line","id":"ASB-A-397217317-4c30e20b","deprecated":false,"target":{"file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360","digest":{"line_hashes":["48824242202000771007508310945523377584","325498635662759965840201795406878624040","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","225841640417887430115579563027318368521"],"threshold":0.9}},{"digest":{"function_hash":"80612551930596608646497750952715777009","length":100},"signature_type":"Function","id":"ASB-A-397217317-9570db9e","deprecated":false,"target":{"function":"isUpdatedSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360","signature_version":"v1"},{"signature_version":"v1","signature_type":"Function","id":"ASB-A-397217317-b9d43048","deprecated":false,"target":{"function":"isSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360","digest":{"function_hash":"38673750997274407261682880125275058068","length":88}},{"deprecated":false,"signature_type":"Function","id":"ASB-A-397217317-fc0927cc","signature_version":"v1","target":{"function":"getCallingPackageName","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/08582e104a16b18f578a69ee9bca418226ba8360","digest":{"function_hash":"219849726313033047941582013681064357104","length":387}}],"types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2"],"vanir_signatures":[{"signature_version":"v1","signature_type":"Line","id":"ASB-A-397217317-0ef81ce8","deprecated":false,"target":{"file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2","digest":{"threshold":0.9,"line_hashes":["48824242202000771007508310945523377584","325498635662759965840201795406878624040","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","225841640417887430115579563027318368521"]}},{"signature_version":"v1","signature_type":"Function","id":"ASB-A-397217317-19030f1f","deprecated":false,"target":{"function":"getCallingPackageName","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2","digest":{"function_hash":"219849726313033047941582013681064357104","length":387}},{"digest":{"function_hash":"80612551930596608646497750952715777009","length":100},"signature_type":"Function","id":"ASB-A-397217317-da490c51","deprecated":false,"target":{"function":"isUpdatedSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2","signature_version":"v1"},{"digest":{"function_hash":"38673750997274407261682880125275058068","length":88},"signature_type":"Function","id":"ASB-A-397217317-e38ea371","deprecated":false,"target":{"function":"isSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/cdad9a0002bdcb09fb8594a71169031c910d25f2","signature_version":"v1"}],"types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"spl":"2026-06-01","vanir_signatures":[{"digest":{"function_hash":"219849726313033047941582013681064357104","length":387},"signature_type":"Function","id":"ASB-A-397217317-23919003","deprecated":false,"target":{"function":"getCallingPackageName","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc","signature_version":"v1"},{"digest":{"line_hashes":["48824242202000771007508310945523377584","325498635662759965840201795406878624040","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","80901011836666089040166712009679233920"],"threshold":0.9},"signature_type":"Line","id":"ASB-A-397217317-7c99c3f1","deprecated":false,"target":{"file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc","signature_version":"v1"},{"digest":{"function_hash":"38673750997274407261682880125275058068","length":88},"signature_type":"Function","id":"ASB-A-397217317-d40a1e98","deprecated":false,"target":{"function":"isSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc","signature_version":"v1"},{"signature_version":"v1","signature_type":"Function","id":"ASB-A-397217317-ee5026ea","deprecated":false,"target":{"function":"isUpdatedSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc","digest":{"function_hash":"80612551930596608646497750952715777009","length":100}}],"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/ad6f3423dd814ae5599237bc15d5f4ca072c77bc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99"],"vanir_signatures":[{"digest":{"function_hash":"219849726313033047941582013681064357104","length":387},"signature_type":"Function","id":"ASB-A-397217317-0b6f76df","deprecated":false,"target":{"function":"getCallingPackageName","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["48824242202000771007508310945523377584","325498635662759965840201795406878624040","323561138117190907110380822680174018117","65415743965004308047591729733479812636","139586179987113903947346816010772098188","338613077567168148189503532332683689180","168456180647270069580637864414621457773","168289643694590275222239970142598954939","252360881713344047199030154100628168038","16049538143845701904592240750317558828","218620902214056641589552916484904121248","82587592119246921571602313652639698905","271788266482599497009122099061488626137","318531081343054827428008377452257620080","300643187459060726765340991358488416312","38669683162161503270728076274733219033","310355640744183645400324554538072947937","225841640417887430115579563027318368521"]},"signature_type":"Line","id":"ASB-A-397217317-32ac511a","deprecated":false,"target":{"file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99","signature_version":"v1"},{"deprecated":false,"signature_type":"Function","id":"ASB-A-397217317-524ec4d2","signature_version":"v1","target":{"function":"isUpdatedSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99","digest":{"function_hash":"80612551930596608646497750952715777009","length":100}},{"digest":{"function_hash":"38673750997274407261682880125275058068","length":88},"signature_type":"Function","id":"ASB-A-397217317-c61ae8fb","deprecated":false,"target":{"function":"isSystemApp","file":"src/com/android/documentsui/base/Shared.java"},"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a08d1c7ea084830a74b9828cc84a1a5380eaad99","signature_version":"v1"}],"types":["EoP"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-397217317.json"}}],"schema_version":"1.7.5"}