{"id":"ASB-A-418776187","details":"In queryInternal of MmsSmsProvider.java, there is a possible way to access MMS/SMS data across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-418776187","CVE-2026-45529"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java","function":"queryInternal"},"deprecated":false,"digest":{"function_hash":"188880999255660073179596386710294385453","length":8050},"id":"ASB-A-418776187-62a83292","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-418776187-88e507f8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2","target":{"function":"getTextSearchQuery","file":"src/com/android/providers/telephony/MmsSmsProvider.java"},"deprecated":false,"digest":{"function_hash":"115852418371893726666298693186447937427","length":1201}},{"digest":{"threshold":0.9,"line_hashes":["136802329616135471664233362941077006905","28691711636404942943129151565909700338","176295319073431672072655273712129123675","130890650755251801856216703833007809773","57656358259527680442444063474892333218","234444472540445350366806441521020852282","27672492891490450420418580039021852511","277699879074650758698282896124363268511","324430731079907372259348064736481606791","206636778078385431955076262011548960319","166294208799980148403719571268555688036","334714996978313036750087516054996875547","17009633391817132282331189091451115850","64043474417064679059821076242644881329","167904958192380504628677465047090773613","50851629648608132099150825168494814799","223388432775768910920057459329326454011","331591775732554817348856681836996512467","54401603461502414977538245383273933042","127440859949272792099447129142163832073","82508640193944607438434798999793587036","141118416137438315961463853621328794322","222426755692545485626279487218058586761","190423102012389054144931852614611045973","179878819981819191237184392893219388408","339646452202614701305698831522823050617","146200940727979671702208086640715949987","45976166416491864126854898888965939775","179404774849306018163078825074439384476","267592098320588670023594456550655836403","147982133334808742802936746850746640097","95216263369590486423596158446173485346","172690904525401890545773017015647306141","191618558072125599522074271844249386973","230741775141976062468833322014044448508","39168555688690438076035169341504214971","295694830112681881210904075318803043711","169525461909817483184047107653610640876","666454788699359580011857178232819547","109651799666511754100999079828735677537","4146283051387891575434168388216485067","223337884050438011219025392804223033222","169830670116710176435960193379510138940","124292021272379332837343334135053194440","218669114776656206751905706704368310351","57088269784231425612392639252025857389","126108984648702824450998775405599655909","248589592794879054592553943597856810635","63932034346910116701132762504166657525","67243975172799998017629671600115478660","321637405442106200371341651925005292639","214285540124007229306558810116208662907"]},"id":"ASB-A-418776187-ef753f98","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418776187.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["136802329616135471664233362941077006905","28691711636404942943129151565909700338","176295319073431672072655273712129123675","130890650755251801856216703833007809773","235475316097154250275043340527786554024","242782141094188487992674006370258409236","189149550968798635948326799958387587076","116262057794230151559796087261446461593","125325987970811906526294499378337441650","176950685375159166537452584878010797564","46954059598559379852697476943871151861","121660500326833587347066330108700255257","197226415908754595787679376049925258294","175144240918627696706389043163020705352","20436973763401286396321817216566876575","330367912133000650234416714133209340575","89643941187703297761987712821495745751","179878819981819191237184392893219388408","339646452202614701305698831522823050617","159396926117267726652544130574558533213","144170050329981353372966156665661183281","262068676558711509831217486618013363205","68194612853305562036906942959198182537","147982133334808742802936746850746640097","188287710402255797747315035948801106767","284101723383781290022219617540114419816","293177386928530964471547645786252086508","15779983341982286451828558391328868055","39168555688690438076035169341504214971","107445837503732636214255104317215840241","310968217894393759923981334338335408596","169186351662557925778398158417814260479","129252227524841832480292152920369279699","44239815851079422320523672381900275345","223337884050438011219025392804223033222","169830670116710176435960193379510138940","124292021272379332837343334135053194440","218669114776656206751905706704368310351","57088269784231425612392639252025857389","126108984648702824450998775405599655909","255617379624037692455693671586636871365","292265071202787058271372941685282380925","53860944455546604474692588456365778634","113117854547287017753798240285429774943"]},"id":"ASB-A-418776187-446515ad","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java","function":"getTextSearchQuery"},"deprecated":false,"digest":{"length":907,"function_hash":"110241711838873038651601426381532248153"},"id":"ASB-A-418776187-ba78c27f"},{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619","target":{"function":"query","file":"src/com/android/providers/telephony/MmsSmsProvider.java"},"deprecated":false,"digest":{"length":7006,"function_hash":"168282920648873990586701718012200262781"},"id":"ASB-A-418776187-f8754e0b","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418776187.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java","function":"getTextSearchQuery"},"deprecated":false,"digest":{"function_hash":"110241711838873038651601426381532248153","length":907},"id":"ASB-A-418776187-29575c51"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["136802329616135471664233362941077006905","28691711636404942943129151565909700338","176295319073431672072655273712129123675","130890650755251801856216703833007809773","235475316097154250275043340527786554024","242782141094188487992674006370258409236","189149550968798635948326799958387587076","116262057794230151559796087261446461593","125325987970811906526294499378337441650","176950685375159166537452584878010797564","46954059598559379852697476943871151861","121660500326833587347066330108700255257","197226415908754595787679376049925258294","175144240918627696706389043163020705352","20436973763401286396321817216566876575","330367912133000650234416714133209340575","89643941187703297761987712821495745751","179878819981819191237184392893219388408","339646452202614701305698831522823050617","159396926117267726652544130574558533213","144170050329981353372966156665661183281","262068676558711509831217486618013363205","68194612853305562036906942959198182537","147982133334808742802936746850746640097","188287710402255797747315035948801106767","284101723383781290022219617540114419816","293177386928530964471547645786252086508","15779983341982286451828558391328868055","39168555688690438076035169341504214971","107445837503732636214255104317215840241","310968217894393759923981334338335408596","169186351662557925778398158417814260479","129252227524841832480292152920369279699","44239815851079422320523672381900275345","223337884050438011219025392804223033222","169830670116710176435960193379510138940","124292021272379332837343334135053194440","218669114776656206751905706704368310351","57088269784231425612392639252025857389","126108984648702824450998775405599655909","255617379624037692455693671586636871365","292265071202787058271372941685282380925","53860944455546604474692588456365778634","113117854547287017753798240285429774943"]},"id":"ASB-A-418776187-72526307","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java","function":"query"},"deprecated":false,"digest":{"function_hash":"168282920648873990586701718012200262781","length":7006},"id":"ASB-A-418776187-c9111547","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418776187.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java","function":"getTextSearchQuery"},"deprecated":false,"digest":{"function_hash":"110241711838873038651601426381532248153","length":907},"id":"ASB-A-418776187-54b093a7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a"},{"digest":{"length":7006,"function_hash":"168282920648873990586701718012200262781"},"id":"ASB-A-418776187-764e4a67","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java","function":"query"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["136802329616135471664233362941077006905","28691711636404942943129151565909700338","176295319073431672072655273712129123675","130890650755251801856216703833007809773","235475316097154250275043340527786554024","242782141094188487992674006370258409236","189149550968798635948326799958387587076","116262057794230151559796087261446461593","125325987970811906526294499378337441650","176950685375159166537452584878010797564","46954059598559379852697476943871151861","121660500326833587347066330108700255257","197226415908754595787679376049925258294","175144240918627696706389043163020705352","20436973763401286396321817216566876575","330367912133000650234416714133209340575","89643941187703297761987712821495745751","179878819981819191237184392893219388408","339646452202614701305698831522823050617","159396926117267726652544130574558533213","144170050329981353372966156665661183281","262068676558711509831217486618013363205","68194612853305562036906942959198182537","147982133334808742802936746850746640097","188287710402255797747315035948801106767","284101723383781290022219617540114419816","293177386928530964471547645786252086508","15779983341982286451828558391328868055","39168555688690438076035169341504214971","107445837503732636214255104317215840241","310968217894393759923981334338335408596","169186351662557925778398158417814260479","129252227524841832480292152920369279699","44239815851079422320523672381900275345","223337884050438011219025392804223033222","169830670116710176435960193379510138940","124292021272379332837343334135053194440","218669114776656206751905706704368310351","57088269784231425612392639252025857389","126108984648702824450998775405599655909","255617379624037692455693671586636871365","292265071202787058271372941685282380925","53860944455546604474692588456365778634","113117854547287017753798240285429774943"],"threshold":0.9},"id":"ASB-A-418776187-85d71857","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"}}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418776187.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java","function":"getTextSearchQuery"},"deprecated":false,"digest":{"function_hash":"115852418371893726666298693186447937427","length":1201},"id":"ASB-A-418776187-1200fa83"},{"deprecated":false,"digest":{"line_hashes":["136802329616135471664233362941077006905","28691711636404942943129151565909700338","176295319073431672072655273712129123675","130890650755251801856216703833007809773","57656358259527680442444063474892333218","234444472540445350366806441521020852282","27672492891490450420418580039021852511","277699879074650758698282896124363268511","324430731079907372259348064736481606791","206636778078385431955076262011548960319","166294208799980148403719571268555688036","334714996978313036750087516054996875547","17009633391817132282331189091451115850","64043474417064679059821076242644881329","167904958192380504628677465047090773613","50851629648608132099150825168494814799","223388432775768910920057459329326454011","331591775732554817348856681836996512467","54401603461502414977538245383273933042","127440859949272792099447129142163832073","82508640193944607438434798999793587036","141118416137438315961463853621328794322","222426755692545485626279487218058586761","190423102012389054144931852614611045973","179878819981819191237184392893219388408","339646452202614701305698831522823050617","146200940727979671702208086640715949987","45976166416491864126854898888965939775","179404774849306018163078825074439384476","267592098320588670023594456550655836403","147982133334808742802936746850746640097","95216263369590486423596158446173485346","172690904525401890545773017015647306141","191618558072125599522074271844249386973","230741775141976062468833322014044448508","39168555688690438076035169341504214971","295694830112681881210904075318803043711","169525461909817483184047107653610640876","666454788699359580011857178232819547","109651799666511754100999079828735677537","4146283051387891575434168388216485067","223337884050438011219025392804223033222","169830670116710176435960193379510138940","124292021272379332837343334135053194440","218669114776656206751905706704368310351","57088269784231425612392639252025857389","126108984648702824450998775405599655909","248589592794879054592553943597856810635","63932034346910116701132762504166657525","67243975172799998017629671600115478660","321637405442106200371341651925005292639","214285540124007229306558810116208662907"],"threshold":0.9},"id":"ASB-A-418776187-76cc1123","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"}},{"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061","target":{"function":"queryInternal","file":"src/com/android/providers/telephony/MmsSmsProvider.java"},"deprecated":false,"digest":{"function_hash":"188880999255660073179596386710294385453","length":8050},"id":"ASB-A-418776187-ac5bcc8a","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418776187.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["136802329616135471664233362941077006905","28691711636404942943129151565909700338","176295319073431672072655273712129123675","130890650755251801856216703833007809773","235475316097154250275043340527786554024","242782141094188487992674006370258409236","189149550968798635948326799958387587076","116262057794230151559796087261446461593","125325987970811906526294499378337441650","176950685375159166537452584878010797564","46954059598559379852697476943871151861","121660500326833587347066330108700255257","197226415908754595787679376049925258294","175144240918627696706389043163020705352","20436973763401286396321817216566876575","330367912133000650234416714133209340575","89643941187703297761987712821495745751","179878819981819191237184392893219388408","339646452202614701305698831522823050617","159396926117267726652544130574558533213","144170050329981353372966156665661183281","262068676558711509831217486618013363205","68194612853305562036906942959198182537","147982133334808742802936746850746640097","188287710402255797747315035948801106767","284101723383781290022219617540114419816","293177386928530964471547645786252086508","15779983341982286451828558391328868055","39168555688690438076035169341504214971","107445837503732636214255104317215840241","310968217894393759923981334338335408596","169186351662557925778398158417814260479","129252227524841832480292152920369279699","44239815851079422320523672381900275345","223337884050438011219025392804223033222","169830670116710176435960193379510138940","124292021272379332837343334135053194440","218669114776656206751905706704368310351","57088269784231425612392639252025857389","126108984648702824450998775405599655909","255617379624037692455693671586636871365","292265071202787058271372941685282380925","53860944455546604474692588456365778634","113117854547287017753798240285429774943"],"threshold":0.9},"id":"ASB-A-418776187-44575b22","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"}},{"target":{"function":"getTextSearchQuery","file":"src/com/android/providers/telephony/MmsSmsProvider.java"},"deprecated":false,"digest":{"function_hash":"110241711838873038651601426381532248153","length":907},"id":"ASB-A-418776187-4f7918d0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669"},{"digest":{"length":6850,"function_hash":"223011726168340967236817226657965545269"},"id":"ASB-A-418776187-c1c797e5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669","target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java","function":"query"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418776187.json"}}],"schema_version":"1.9.0"}