{"id":"ASB-A-445418705","details":"In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-445418705","CVE-2026-0078"],"modified":"2026-06-23T15:45:40.410020820Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/50cbf4422ac8e930c522642f5dce0724581a6aa9"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-06-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/64a559cbc04fc61777989cff0b189f423323cfb5"],"vanir_signatures":[{"digest":{"function_hash":"142823809086880022234764459838481887623","length":1145},"target":{"function":"setGlobalProxy","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"signature_type":"Function","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/64a559cbc04fc61777989cff0b189f423323cfb5","signature_version":"v1","id":"ASB-A-445418705-021233da"},{"deprecated":false,"target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"signature_type":"Line","source":"https://android.googlesource.com/platform/frameworks/base/+/64a559cbc04fc61777989cff0b189f423323cfb5","digest":{"threshold":0.9,"line_hashes":["327457677134402974318899540853853534982","9587636024942198925881020435161507952","82063547044743837200153402558375784615"]},"signature_version":"v1","id":"ASB-A-445418705-15cc4d9a"}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-445418705.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/a7cb04f968839559ba75072e17fb2f1128f5afe4"],"vanir_signatures":[{"digest":{"function_hash":"175431350370518345770120282350445003279","length":1100},"target":{"function":"setGlobalProxy","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"signature_type":"Function","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/a7cb04f968839559ba75072e17fb2f1128f5afe4","signature_version":"v1","id":"ASB-A-445418705-2a2b0d60"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a7cb04f968839559ba75072e17fb2f1128f5afe4","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"signature_type":"Line","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["327457677134402974318899540853853534982","9587636024942198925881020435161507952","82063547044743837200153402558375784615"]},"signature_version":"v1","id":"ASB-A-445418705-2db5f828"}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-445418705.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/0dc0cf0be184244582e501f1d0923c78f1ae6b3c"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/0dc0cf0be184244582e501f1d0923c78f1ae6b3c","signature_type":"Function","target":{"function":"setGlobalProxy","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"deprecated":false,"digest":{"function_hash":"175431350370518345770120282350445003279","length":1100},"signature_version":"v1","id":"ASB-A-445418705-b4378607"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/0dc0cf0be184244582e501f1d0923c78f1ae6b3c","target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["327457677134402974318899540853853534982","9587636024942198925881020435161507952","82063547044743837200153402558375784615"]},"deprecated":false,"signature_version":"v1","id":"ASB-A-445418705-c82c8cc3"}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-445418705.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/aefee56aefddab829ec3733daba9eccfd0f42b5c"],"vanir_signatures":[{"deprecated":false,"signature_type":"Function","target":{"function":"setGlobalProxy","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/aefee56aefddab829ec3733daba9eccfd0f42b5c","digest":{"function_hash":"175431350370518345770120282350445003279","length":1100},"signature_version":"v1","id":"ASB-A-445418705-106e6fb7"},{"digest":{"threshold":0.9,"line_hashes":["327457677134402974318899540853853534982","9587636024942198925881020435161507952","82063547044743837200153402558375784615"]},"target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"signature_type":"Line","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/aefee56aefddab829ec3733daba9eccfd0f42b5c","signature_version":"v1","id":"ASB-A-445418705-93134c30"}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-445418705.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-06-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/8b7d81b50b8ce461168f39d275f75730e1111ba7"],"vanir_signatures":[{"deprecated":false,"signature_type":"Function","target":{"function":"setGlobalProxy","file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/8b7d81b50b8ce461168f39d275f75730e1111ba7","digest":{"function_hash":"175431350370518345770120282350445003279","length":1100},"signature_version":"v1","id":"ASB-A-445418705-247e7784"},{"deprecated":false,"target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"},"signature_type":"Line","source":"https://android.googlesource.com/platform/frameworks/base/+/8b7d81b50b8ce461168f39d275f75730e1111ba7","digest":{"threshold":0.9,"line_hashes":["65383044451450088293606005854642619383","159936200850751029600833555055021269930","19745850214737326736913418988541692735","21344383000083744290769515150609826893","327457677134402974318899540853853534982","9587636024942198925881020435161507952","82063547044743837200153402558375784615"]},"signature_version":"v1","id":"ASB-A-445418705-cc46dc2d"}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-445418705.json"}}],"schema_version":"1.7.5"}