{"id":"ASB-A-453649815","details":"In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-453649815","CVE-2026-0020"],"modified":"2026-07-27T15:26:09.415486180Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/e770e9f0234158f4631c7147b64a1d70e0843d0b"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"deprecated":false,"digest":{"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","93880748564658568240213823021265883614","299284021734725228359553138313644958845","338971611199277947813557304818585601362","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"],"threshold":0.9},"id":"ASB-A-453649815-5fb2132a","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":1701,"function_hash":"307197250383847921553552304388472930776"},"id":"ASB-A-453649815-66e54a7a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermissionGroup"}},{"digest":{"function_hash":"75410298483051398371478044204999183565","length":1362},"id":"ASB-A-453649815-8899fee9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermissionTree"},"deprecated":false},{"id":"ASB-A-453649815-eaf9f100","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db","target":{"function":"parsePermission","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"deprecated":false,"digest":{"function_hash":"214181287774654884996589223407677553740","length":4496}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-453649815-111c2f02","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermissionGroup"},"deprecated":false,"digest":{"function_hash":"307197250383847921553552304388472930776","length":1701}},{"target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"deprecated":false,"digest":{"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","93880748564658568240213823021265883614","299284021734725228359553138313644958845","338971611199277947813557304818585601362","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"],"threshold":0.9},"id":"ASB-A-453649815-2675b079","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermissionTree"},"deprecated":false,"digest":{"length":1362,"function_hash":"75410298483051398371478044204999183565"},"id":"ASB-A-453649815-3fdc0d26","signature_type":"Function"},{"digest":{"length":3787,"function_hash":"171546194080724224317806436492206797025"},"id":"ASB-A-453649815-4434035d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc","target":{"function":"parsePermission","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":1362,"function_hash":"75410298483051398371478044204999183565"},"id":"ASB-A-453649815-6300a20d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312","target":{"function":"parsePermissionTree","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"}},{"deprecated":false,"digest":{"function_hash":"9964124652194516891401584017719602327","length":3992},"id":"ASB-A-453649815-cff4cbc0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermission"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312","target":{"function":"parsePermissionGroup","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"deprecated":false,"digest":{"function_hash":"307197250383847921553552304388472930776","length":1701},"id":"ASB-A-453649815-fa351a84","signature_type":"Function"},{"target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","93880748564658568240213823021265883614","299284021734725228359553138313644958845","338971611199277947813557304818585601362","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"]},"id":"ASB-A-453649815-ff253965","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-03-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"75410298483051398371478044204999183565","length":1362},"id":"ASB-A-453649815-17c79233","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermissionTree"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermissionGroup"},"deprecated":false,"digest":{"length":1701,"function_hash":"307197250383847921553552304388472930776"},"id":"ASB-A-453649815-b9e138c4","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","93880748564658568240213823021265883614","299284021734725228359553138313644958845","338971611199277947813557304818585601362","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"],"threshold":0.9},"id":"ASB-A-453649815-d46bc88c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"}},{"deprecated":false,"digest":{"function_hash":"100367624945478362435341245134677640622","length":4259},"id":"ASB-A-453649815-f1510039","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9","target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermission"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"307197250383847921553552304388472930776","length":1701},"id":"ASB-A-453649815-55529ef4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159","target":{"file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermissionGroup"}},{"target":{"file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java"},"deprecated":false,"digest":{"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","104168900281175770704150283408488404420","213408616555746969833058379049904554895","241245247665758687246550798032403209503","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"],"threshold":0.9},"id":"ASB-A-453649815-69518bc1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159","target":{"file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java","function":"parsePermission"},"deprecated":false,"digest":{"length":3787,"function_hash":"171546194080724224317806436492206797025"},"id":"ASB-A-453649815-8410f889","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-453649815-8e4ece56","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159","target":{"function":"parsePermissionTree","file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java"},"deprecated":false,"digest":{"length":1362,"function_hash":"75410298483051398371478044204999183565"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}}],"schema_version":"1.7.5"}