{"id":"ASB-A-459460815","details":"In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-459460815","CVE-2026-58978"],"modified":"2026-11-02T16:56:16.903865960Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fbf97426953f3a8819e51a2451ab3ffdb5902df9","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false,"digest":{"line_hashes":["314677869122922379937794292893576028583","304223255185766239649078299243393751053","106317118346291700596767444688036184132","155797385917050877286553933251806499579"],"threshold":0.9},"id":"ASB-A-459460815-3dc22dce"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/fbf97426953f3a8819e51a2451ab3ffdb5902df9","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java","function":"createSessionInternal"},"deprecated":false,"digest":{"function_hash":"206533760152785236654610260021587768659","length":12640},"id":"ASB-A-459460815-aae2cb3d","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["186551410752662410588283544314187352975","339404943175700234522325329061851695575","55893281515692248461050767705151310201","290163043238867212467644898633600551092"],"threshold":0.9},"id":"ASB-A-459460815-d775e2af","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fbf97426953f3a8819e51a2451ab3ffdb5902df9","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fbf97426953f3a8819e51a2451ab3ffdb5902df9","target":{"function":"preparePackage","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"length":16530,"function_hash":"307879331622393067155355020010537248767"},"id":"ASB-A-459460815-f750618d"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fbf97426953f3a8819e51a2451ab3ffdb5902df9"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bc07730f77913a353f1a8db245c92d8da857a017"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bc07730f77913a353f1a8db245c92d8da857a017","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"line_hashes":["186551410752662410588283544314187352975","339404943175700234522325329061851695575","55893281515692248461050767705151310201","290163043238867212467644898633600551092"],"threshold":0.9},"id":"ASB-A-459460815-11a4a19b"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/bc07730f77913a353f1a8db245c92d8da857a017","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false,"digest":{"line_hashes":["314677869122922379937794292893576028583","304223255185766239649078299243393751053","11933691988270229335176804288153095066","21458183491295109203597374139803584881"],"threshold":0.9},"id":"ASB-A-459460815-6b95ae6b","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/bc07730f77913a353f1a8db245c92d8da857a017","target":{"function":"preparePackageLI","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"function_hash":"132716465581908396416252676144453751856","length":19075},"id":"ASB-A-459460815-af00a674","signature_type":"Function","signature_version":"v1"},{"digest":{"length":11887,"function_hash":"197109079118940328694841016232749120321"},"id":"ASB-A-459460815-eb495b9b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bc07730f77913a353f1a8db245c92d8da857a017","target":{"function":"createSessionInternal","file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"109616767100055152360954628222147602817","length":11894},"id":"ASB-A-459460815-60f3e99f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/403d5f08603d2b4835544cfce7fbc499ef1e3c15","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java","function":"createSessionInternal"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["314677869122922379937794292893576028583","304223255185766239649078299243393751053","11933691988270229335176804288153095066","21458183491295109203597374139803584881"]},"id":"ASB-A-459460815-6a3c10b6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/403d5f08603d2b4835544cfce7fbc499ef1e3c15","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java"}},{"deprecated":false,"digest":{"length":19784,"function_hash":"14805577808970925598107780802664541428"},"id":"ASB-A-459460815-765308bb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/403d5f08603d2b4835544cfce7fbc499ef1e3c15","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java","function":"preparePackage"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/403d5f08603d2b4835544cfce7fbc499ef1e3c15","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"line_hashes":["186551410752662410588283544314187352975","339404943175700234522325329061851695575","55893281515692248461050767705151310201","290163043238867212467644898633600551092"],"threshold":0.9},"id":"ASB-A-459460815-c9e98c13","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/403d5f08603d2b4835544cfce7fbc499ef1e3c15"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-459460815-2bd9702a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8f2432aee2b6171b78664bf64e53ea466fb52854","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java","function":"createSessionInternal"},"deprecated":false,"digest":{"function_hash":"80319328743477172111003081975369717725","length":12940}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8f2432aee2b6171b78664bf64e53ea466fb52854","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["314677869122922379937794292893576028583","304223255185766239649078299243393751053","106317118346291700596767444688036184132","155797385917050877286553933251806499579"]},"id":"ASB-A-459460815-878ba91a"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8f2432aee2b6171b78664bf64e53ea466fb52854","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"line_hashes":["186551410752662410588283544314187352975","339404943175700234522325329061851695575","55893281515692248461050767705151310201","290163043238867212467644898633600551092"],"threshold":0.9},"id":"ASB-A-459460815-c5c4ad76","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"292216073574346736618866576132995523201","length":19762},"id":"ASB-A-459460815-dc7b01f6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8f2432aee2b6171b78664bf64e53ea466fb52854","target":{"function":"preparePackage","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8f2432aee2b6171b78664bf64e53ea466fb52854"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java","function":"preparePackage"},"deprecated":false,"digest":{"function_hash":"323866682935126751726445002076852478562","length":19930},"id":"ASB-A-459460815-99ec922b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7d1342ffc94dbfa4e09c351acf17517e6af8d929"},{"target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["186551410752662410588283544314187352975","339404943175700234522325329061851695575","55893281515692248461050767705151310201","290163043238867212467644898633600551092"]},"id":"ASB-A-459460815-b932ea61","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7d1342ffc94dbfa4e09c351acf17517e6af8d929"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/7d1342ffc94dbfa4e09c351acf17517e6af8d929","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["314677869122922379937794292893576028583","304223255185766239649078299243393751053","106317118346291700596767444688036184132","155797385917050877286553933251806499579"]},"id":"ASB-A-459460815-e8f7aa27","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7d1342ffc94dbfa4e09c351acf17517e6af8d929","target":{"function":"createSessionInternal","file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false,"digest":{"length":12538,"function_hash":"339327758139634429047389944931874561486"},"id":"ASB-A-459460815-f196d2cb"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7d1342ffc94dbfa4e09c351acf17517e6af8d929"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460815.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/63af4340de981a2dea7ee029bdb575d2ba392466"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-459460815-28ff1dda","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63af4340de981a2dea7ee029bdb575d2ba392466","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java","function":"createSessionInternal"},"deprecated":false,"digest":{"function_hash":"196250433924074493780752858096566010478","length":10207}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63af4340de981a2dea7ee029bdb575d2ba392466","target":{"file":"services/core/java/com/android/server/pm/PackageInstallerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["314677869122922379937794292893576028583","304223255185766239649078299243393751053","314976761557908602855071991376417878636","157016655399101368792996001414423487623"]},"id":"ASB-A-459460815-44445cda","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63af4340de981a2dea7ee029bdb575d2ba392466","target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false,"digest":{"line_hashes":["186551410752662410588283544314187352975","339404943175700234522325329061851695575","55893281515692248461050767705151310201","290163043238867212467644898633600551092"],"threshold":0.9},"id":"ASB-A-459460815-557d087d"},{"digest":{"function_hash":"32982494306534494045136733355171161469","length":18785},"id":"ASB-A-459460815-88950251","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/63af4340de981a2dea7ee029bdb575d2ba392466","target":{"function":"preparePackageLI","file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-459460815.json"}}],"schema_version":"1.9.2"}