{"id":"ASB-A-453649815","details":"In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-453649815","CVE-2026-0020"],"modified":"2026-04-29T15:10:00.007170Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/e770e9f0234158f4631c7147b64a1d70e0843d0b"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db","id":"ASB-A-453649815-5fb2132a","digest":{"threshold":0.9,"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","93880748564658568240213823021265883614","299284021734725228359553138313644958845","338971611199277947813557304818585601362","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"]},"signature_type":"Line"},{"deprecated":false,"target":{"function":"parsePermissionGroup","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db","id":"ASB-A-453649815-66e54a7a","digest":{"length":1701,"function_hash":"307197250383847921553552304388472930776"},"signature_type":"Function"},{"deprecated":false,"target":{"function":"parsePermissionTree","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db","id":"ASB-A-453649815-8899fee9","digest":{"length":1362,"function_hash":"75410298483051398371478044204999183565"},"signature_type":"Function"},{"deprecated":false,"target":{"function":"parsePermission","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db","id":"ASB-A-453649815-eaf9f100","digest":{"length":4496,"function_hash":"214181287774654884996589223407677553740"},"signature_type":"Function"}],"types":["EoP"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db"],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"target":{"function":"parsePermissionGroup","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc","id":"ASB-A-453649815-111c2f02","digest":{"length":1701,"function_hash":"307197250383847921553552304388472930776"},"signature_type":"Function"},{"deprecated":false,"target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc","id":"ASB-A-453649815-2675b079","digest":{"threshold":0.9,"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","93880748564658568240213823021265883614","299284021734725228359553138313644958845","338971611199277947813557304818585601362","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"]},"signature_type":"Line"},{"deprecated":false,"target":{"function":"parsePermissionTree","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc","id":"ASB-A-453649815-3fdc0d26","digest":{"length":1362,"function_hash":"75410298483051398371478044204999183565"},"signature_type":"Function"},{"deprecated":false,"target":{"function":"parsePermission","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc","id":"ASB-A-453649815-4434035d","digest":{"length":3787,"function_hash":"171546194080724224317806436492206797025"},"signature_type":"Function"}],"types":["EoP"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc"],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"target":{"function":"parsePermissionTree","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312","id":"ASB-A-453649815-6300a20d","digest":{"length":1362,"function_hash":"75410298483051398371478044204999183565"},"signature_type":"Function"},{"deprecated":false,"target":{"function":"parsePermission","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312","id":"ASB-A-453649815-cff4cbc0","digest":{"length":3992,"function_hash":"9964124652194516891401584017719602327"},"signature_type":"Function"},{"deprecated":false,"target":{"function":"parsePermissionGroup","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312","id":"ASB-A-453649815-fa351a84","digest":{"length":1701,"function_hash":"307197250383847921553552304388472930776"},"signature_type":"Function"},{"deprecated":false,"target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312","id":"ASB-A-453649815-ff253965","digest":{"threshold":0.9,"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","93880748564658568240213823021265883614","299284021734725228359553138313644958845","338971611199277947813557304818585601362","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"]},"signature_type":"Line"}],"types":["EoP"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312"],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-03-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"target":{"function":"parsePermissionTree","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9","id":"ASB-A-453649815-17c79233","digest":{"length":1362,"function_hash":"75410298483051398371478044204999183565"},"signature_type":"Function"},{"deprecated":false,"target":{"function":"parsePermissionGroup","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9","id":"ASB-A-453649815-b9e138c4","digest":{"length":1701,"function_hash":"307197250383847921553552304388472930776"},"signature_type":"Function"},{"deprecated":false,"target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9","id":"ASB-A-453649815-d46bc88c","digest":{"threshold":0.9,"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","93880748564658568240213823021265883614","299284021734725228359553138313644958845","338971611199277947813557304818585601362","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"]},"signature_type":"Line"},{"deprecated":false,"target":{"function":"parsePermission","file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9","id":"ASB-A-453649815-f1510039","digest":{"length":4259,"function_hash":"100367624945478362435341245134677640622"},"signature_type":"Function"}],"types":["EoP"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9"],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"target":{"function":"parsePermissionGroup","file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159","id":"ASB-A-453649815-55529ef4","digest":{"length":1701,"function_hash":"307197250383847921553552304388472930776"},"signature_type":"Function"},{"deprecated":false,"target":{"file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159","id":"ASB-A-453649815-69518bc1","digest":{"threshold":0.9,"line_hashes":["196274197830684393603816840329676925730","2404267374424135568335899747231607115","300463444893902331628350183110238282543","104168900281175770704150283408488404420","213408616555746969833058379049904554895","241245247665758687246550798032403209503","107903467293318276817457347624333649939","241354316311511334352956278769152469088","109641792464862920889058802367256591500","311121239974498965218535932728880710853"]},"signature_type":"Line"},{"deprecated":false,"target":{"function":"parsePermission","file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159","id":"ASB-A-453649815-8410f889","digest":{"length":3787,"function_hash":"171546194080724224317806436492206797025"},"signature_type":"Function"},{"deprecated":false,"target":{"function":"parsePermissionTree","file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java"},"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159","id":"ASB-A-453649815-8e4ece56","digest":{"length":1362,"function_hash":"75410298483051398371478044204999183565"},"signature_type":"Function"}],"types":["EoP"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159"],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-453649815.json"}}],"schema_version":"1.7.5"}