{"id":"ASB-A-454062218","details":"In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-454062218","CVE-2026-0011"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/51368785bd09cd652ed9851727b16545cb92c4e5"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869","https://android.googlesource.com/platform/frameworks/base/+/dba78af51647402d8233bd4c52ecb3c3551622a4"],"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-454062218-16d6e914","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869","target":{"function":"addPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false,"digest":{"length":661,"function_hash":"284319997343437165940897188224211807351"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"enableSystemPackageLPw"},"deprecated":false,"digest":{"function_hash":"125525195444894464217750330831410874590","length":1425},"id":"ASB-A-454062218-502158f4","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dba78af51647402d8233bd4c52ecb3c3551622a4","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"addPackageLPw"},"deprecated":false,"digest":{"function_hash":"37429192823054701599339793877573588661","length":712},"id":"ASB-A-454062218-51dab3ff","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dba78af51647402d8233bd4c52ecb3c3551622a4","target":{"function":"enableSystemPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false,"digest":{"function_hash":"48403598448649539613722876273985614636","length":1518},"id":"ASB-A-454062218-5759ac0b","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869","target":{"file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false,"digest":{"line_hashes":["193113628533422175067756173000827679994","309213008556413727970549784491072885555","103915627977762916572369854172376953855","270127856189385190131160968200975479895","331893266207625245204074903190443087899","255973484546427106109957016636518011297","155557292261108720229786485200282669595","64052198750897090704486203272274023043","290286764007979456270792027756986547649","2494170172020733298864325503100546890","98032843297654820866704555570670938284","142833129536356055003338544649091743284","81741354079129105791891338335974593241","80381060306142723617551929211147565004","197676826216394513519894417943599559895","212535098048582496322705205159881901718","141935063808271989837062787007033630046","158869717454838622534477537067446210174","81034217693563637724627856537760142288","6905083402804303387014043728206991340","271853793945591977299721426559251769222"],"threshold":0.9},"id":"ASB-A-454062218-6148dbcd","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dba78af51647402d8233bd4c52ecb3c3551622a4","target":{"file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false,"digest":{"line_hashes":["316867027641701166918113132828405250120","306101848189449927544461664582677657539","167312462958623487465829480202863536195","65913692504432659568103555173690217207","35234445888640034440272080271747605958","190157433669808701997394496779730337604","228467059057335538794274452515090745701","85757746947730342474972168303908841824","194710885136322853754508194209847200640","83096127407422219721948552729784938627"],"threshold":0.9},"id":"ASB-A-454062218-706c68a0","signature_type":"Line"},{"id":"ASB-A-454062218-c496a497","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6b5ea2f7fbf50313d46e54e0d8f8c18c398e4869","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"readPackageLPw"},"deprecated":false,"digest":{"length":11716,"function_hash":"288397329113914151108030394943692643022"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false,"digest":{"line_hashes":["193113628533422175067756173000827679994","309213008556413727970549784491072885555","103915627977762916572369854172376953855","270127856189385190131160968200975479895","331893266207625245204074903190443087899","255973484546427106109957016636518011297","155557292261108720229786485200282669595","64052198750897090704486203272274023043","290286764007979456270792027756986547649","2494170172020733298864325503100546890","98032843297654820866704555570670938284","142833129536356055003338544649091743284","81741354079129105791891338335974593241","80381060306142723617551929211147565004","197676826216394513519894417943599559895","212535098048582496322705205159881901718","141935063808271989837062787007033630046","158869717454838622534477537067446210174","81034217693563637724627856537760142288","6905083402804303387014043728206991340","271853793945591977299721426559251769222"],"threshold":0.9},"id":"ASB-A-454062218-03620439","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880"},{"target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"readPackageLPw"},"deprecated":false,"digest":{"function_hash":"334617102533654471552284364481224219330","length":10768},"id":"ASB-A-454062218-4929763e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880","target":{"function":"addPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false,"digest":{"function_hash":"284319997343437165940897188224211807351","length":661},"id":"ASB-A-454062218-6668a63c"},{"digest":{"function_hash":"125525195444894464217750330831410874590","length":1425},"id":"ASB-A-454062218-ad073264","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"enableSystemPackageLPw"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4b32b0bd6876ecc25d60d95431763bf618699880"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":661,"function_hash":"284319997343437165940897188224211807351"},"id":"ASB-A-454062218-6c616d47","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"addPackageLPw"}},{"digest":{"function_hash":"211106132936534084502720084199233022640","length":11182},"id":"ASB-A-454062218-c721a06b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0","target":{"function":"readPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0","target":{"file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false,"digest":{"line_hashes":["193113628533422175067756173000827679994","309213008556413727970549784491072885555","103915627977762916572369854172376953855","270127856189385190131160968200975479895","331893266207625245204074903190443087899","255973484546427106109957016636518011297","155557292261108720229786485200282669595","64052198750897090704486203272274023043","290286764007979456270792027756986547649","2494170172020733298864325503100546890","98032843297654820866704555570670938284","142833129536356055003338544649091743284","81741354079129105791891338335974593241","80381060306142723617551929211147565004","197676826216394513519894417943599559895","212535098048582496322705205159881901718","141935063808271989837062787007033630046","158869717454838622534477537067446210174","81034217693563637724627856537760142288","6905083402804303387014043728206991340","271853793945591977299721426559251769222"],"threshold":0.9},"id":"ASB-A-454062218-ccc4fb5c","signature_type":"Line"},{"id":"ASB-A-454062218-e6bcb9cd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"enableSystemPackageLPw"},"deprecated":false,"digest":{"function_hash":"125525195444894464217750330831410874590","length":1425}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/740256b41ba113708655f82dc5664291bf79edd0"],"severity":"High","spl":"2026-03-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-03-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-454062218-328e701e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"addPackageLPw"},"deprecated":false,"digest":{"function_hash":"284319997343437165940897188224211807351","length":661}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"enableSystemPackageLPw"},"deprecated":false,"digest":{"length":1425,"function_hash":"125525195444894464217750330831410874590"},"id":"ASB-A-454062218-3ad9431f","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["193113628533422175067756173000827679994","309213008556413727970549784491072885555","103915627977762916572369854172376953855","270127856189385190131160968200975479895","331893266207625245204074903190443087899","255973484546427106109957016636518011297","155557292261108720229786485200282669595","64052198750897090704486203272274023043","290286764007979456270792027756986547649","2494170172020733298864325503100546890","98032843297654820866704555570670938284","142833129536356055003338544649091743284","81741354079129105791891338335974593241","80381060306142723617551929211147565004","197676826216394513519894417943599559895","212535098048582496322705205159881901718","141935063808271989837062787007033630046","158869717454838622534477537067446210174","81034217693563637724627856537760142288","6905083402804303387014043728206991340","271853793945591977299721426559251769222"],"threshold":0.9},"id":"ASB-A-454062218-5d481de1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850","target":{"file":"services/core/java/com/android/server/pm/Settings.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850","target":{"function":"readPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false,"digest":{"function_hash":"264395599137339639107651047999758842093","length":11613},"id":"ASB-A-454062218-d459f8fa","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/73b1785a9f8893a2419c4f260b425a152fe75850"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"readPackageLPw"},"deprecated":false,"digest":{"function_hash":"137784312276013940340327891707124488837","length":9995},"id":"ASB-A-454062218-80b7dc02","signature_type":"Function","signature_version":"v1"},{"target":{"file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false,"digest":{"line_hashes":["224402722255896372297002727977158473518","64902452747486425988219297442902021335","50901606693728845590594171921752281941","292156504327675538663829928951282757895","164481467575030133943999691231751841547","37406276584328005671714621304520468273","215148686837882964143970126678391733537","335516374965104949799896044360537153888","168140497931974869983212923874137392983","156531654576830406430712702951441447560","138393851297676093797771619697090569653","228718581690540988277919725956730339920","83885092042609357490336318926515996256","45606039818385214155443337296054601198","132383651890466863833289270875205444764","310809837497482768015315402934777498564","38510742911989735377743417480857656159","213400700073499038942915101588328699376","68298697726680042253384060064172673124"],"threshold":0.9},"id":"ASB-A-454062218-83662c44","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc"},{"deprecated":false,"digest":{"function_hash":"135924383374685116244805398144046121058","length":806},"id":"ASB-A-454062218-879ccb76","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc","target":{"file":"services/core/java/com/android/server/pm/Settings.java","function":"addPackageLPw"}},{"digest":{"length":913,"function_hash":"240461939662953300303024880342708923427"},"id":"ASB-A-454062218-ce17854c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc","target":{"function":"enableSystemPackageLPw","file":"services/core/java/com/android/server/pm/Settings.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ebd26d85a9e59569e587d5ad6384c1a0fe4440cc"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-454062218.json"}}],"schema_version":"1.9.0"}