{"id":"ASB-A-460933604","details":"In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-460933604","CVE-2026-0016"],"modified":"2026-06-25T15:18:14.132838247Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/10b748dbc3488c8deb232f47b923c93d8ab01371"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/ffdfa5c70fcaeabb63ef0ec41c33acd2466316dd"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357"],"types":["ID"],"spl":"2026-06-01","vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357","digest":{"threshold":0.9,"line_hashes":["236757797298643586277567079489527692433","260400859541391930397799917262971480305","89796163820097067758905871865778352977","152470181634356134627737138537383340738","19337287797833759647307589339832905124","26261039252615956348419202102995204716","40656838338137506166043175060196105359","203996167164111863555529920133933214782","33185206605665109979423100066898173404","165686225044220713529576350913828951629","335057009792386384466136480693084522621","205890249286301262013717503706130497784","238686073049658378032961040442748498945","68799971003637895160595676149811163745","98800465716778407554145470769434258469","297939398198302139966976124503099166615","244684080444139417345540975757663496257","65670089475461021476906667660325210385","339607428233238850237374646557154643291","217431951705329233002013900317071296733","100169523158442018145175155576939804633","275161592794845742554827089389965258716","45597638232354367525610921186700034828","39841570399783724898653025584690605558","27100486196900892471356722060236511558","244912167370129635279597947671894268558","218549456482241477253132316775158941870"]},"signature_version":"v1","id":"ASB-A-460933604-0427ac15","signature_type":"Line","deprecated":false,"target":{"file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java"}},{"target":{"function":"removeInvalidCachedServicesLocked","file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java"},"digest":{"function_hash":"292971561053830502429299222423501722906","length":252},"signature_version":"v1","id":"ASB-A-460933604-0c8385f0","signature_type":"Function","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357","digest":{"function_hash":"74419033187255781104100432760116064829","length":1224},"signature_version":"v1","id":"ASB-A-460933604-61fdc99e","signature_type":"Function","deprecated":false,"target":{"function":"updateProvidersWhenServiceRemoved","file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java"}},{"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["231003889080206413797443448172764758858","117066040151103728792130533856058562185","148201188374718905640009909042790610070","146396725481014504161548083299177762175","200303445894465411110734461672330751593"]},"target":{"file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java"},"id":"ASB-A-460933604-f63334c0","signature_type":"Line","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-460933604.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6","https://android.googlesource.com/platform/frameworks/base/+/67619d9eb580710bc82a2bbf95677d41476c6bef"],"types":["ID"],"spl":"2026-06-01","vanir_signatures":[{"target":{"function":"updateProvidersWhenServiceRemoved","file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java"},"digest":{"function_hash":"74419033187255781104100432760116064829","length":1224},"source":"https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6","id":"ASB-A-460933604-2198582f","signature_type":"Function","deprecated":false,"signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6","digest":{"threshold":0.9,"line_hashes":["231003889080206413797443448172764758858","117066040151103728792130533856058562185","148201188374718905640009909042790610070","146396725481014504161548083299177762175","200303445894465411110734461672330751593"]},"signature_version":"v1","id":"ASB-A-460933604-afd882d6","signature_type":"Line","deprecated":false,"target":{"file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6","digest":{"function_hash":"292971561053830502429299222423501722906","length":252},"signature_version":"v1","id":"ASB-A-460933604-e2834c21","signature_type":"Function","deprecated":false,"target":{"function":"removeInvalidCachedServicesLocked","file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java"}},{"target":{"file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java"},"digest":{"threshold":0.9,"line_hashes":["40656838338137506166043175060196105359","203996167164111863555529920133933214782","33185206605665109979423100066898173404","165686225044220713529576350913828951629","335057009792386384466136480693084522621","98800465716778407554145470769434258469","297939398198302139966976124503099166615","244684080444139417345540975757663496257","65670089475461021476906667660325210385","339607428233238850237374646557154643291","275161592794845742554827089389965258716","45597638232354367525610921186700034828","39841570399783724898653025584690605558","27100486196900892471356722060236511558"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6","id":"ASB-A-460933604-febaffa7","signature_type":"Line","deprecated":false,"signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-460933604.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c","https://android.googlesource.com/platform/frameworks/base/+/509569d8352076426523cd7c01891880c0a90307"],"types":["ID"],"spl":"2026-06-01","vanir_signatures":[{"target":{"file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java"},"digest":{"threshold":0.9,"line_hashes":["203996167164111863555529920133933214782","33185206605665109979423100066898173404","165686225044220713529576350913828951629","335057009792386384466136480693084522621","68799971003637895160595676149811163745","98800465716778407554145470769434258469","297939398198302139966976124503099166615","244684080444139417345540975757663496257","65670089475461021476906667660325210385","339607428233238850237374646557154643291","275161592794845742554827089389965258716","45597638232354367525610921186700034828","39841570399783724898653025584690605558","27100486196900892471356722060236511558"]},"signature_version":"v1","id":"ASB-A-460933604-65bf59e4","signature_type":"Line","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c"},{"signature_version":"v1","digest":{"function_hash":"292971561053830502429299222423501722906","length":252},"target":{"function":"removeInvalidCachedServicesLocked","file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java"},"id":"ASB-A-460933604-73b68a7a","signature_type":"Function","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c"},{"target":{"file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java"},"digest":{"threshold":0.9,"line_hashes":["231003889080206413797443448172764758858","117066040151103728792130533856058562185","148201188374718905640009909042790610070","146396725481014504161548083299177762175","200303445894465411110734461672330751593"]},"signature_version":"v1","id":"ASB-A-460933604-aff997d4","signature_type":"Line","deprecated":false,"source":"https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c","digest":{"function_hash":"74419033187255781104100432760116064829","length":1224},"signature_version":"v1","id":"ASB-A-460933604-bffd0aea","signature_type":"Function","deprecated":false,"target":{"function":"updateProvidersWhenServiceRemoved","file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-460933604.json"}}],"schema_version":"1.7.5"}