{"id":"ASB-A-461500706","details":"In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-461500706","CVE-2026-28631"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false,"digest":{"line_hashes":["78139153521333413375691220346111554848","22117557816079280115461150826927296930","22236105038616136280216033962554511711","331192511457113304253531561818596609096"],"threshold":0.9},"id":"ASB-A-461500706-0496c580","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/426df92120398800fc185c7540f6263a58cbea2d"},{"target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"275600975068241849699869813208466523774","length":1710},"id":"ASB-A-461500706-0f22c187","match_only_versions":["17-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7722192034b5aa341b46cf7803bad3050cf6a054"},{"match_only_versions":["17-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7722192034b5aa341b46cf7803bad3050cf6a054","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["151257780129023544978963930218942193362","114736881790020246893202071589709360605","113727632206974886353707745357651912544","215030698924241381202671228134672837834","335097099142340031416459041471911055346","136567066977832655758858044248128329832","247047352691011741949288614955118646481","282610005211683422463218026581057951122","290239436913716466994902491240806381237","177209998832725559019748183461050806389","7147032207968402908323949559221056306","56419335929094113911132560272243684991","129683992516956698035414025774403438917","120609988045666988121400073853647420946","325850132597459714713299309192660703042","140087489249634326301456327272266307535"]},"id":"ASB-A-461500706-3e9ef8e0"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/426df92120398800fc185c7540f6263a58cbea2d","target":{"function":"buildMiniResolver","file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false,"digest":{"function_hash":"70802502375059167023747500290520995705","length":850},"id":"ASB-A-461500706-6cd8b2a0","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/426df92120398800fc185c7540f6263a58cbea2d","https://android.googlesource.com/platform/frameworks/base/+/7722192034b5aa341b46cf7803bad3050cf6a054"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/61d262e6eecffba83604886470a28e636b3fac5a","https://android.googlesource.com/platform/frameworks/base/+/05df4e24983caaf46c9d35d82d5eaa7b7557fbab"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["151257780129023544978963930218942193362","114736881790020246893202071589709360605","113727632206974886353707745357651912544","215030698924241381202671228134672837834","335097099142340031416459041471911055346","136567066977832655758858044248128329832","247047352691011741949288614955118646481","282610005211683422463218026581057951122","290239436913716466994902491240806381237","177209998832725559019748183461050806389","7147032207968402908323949559221056306","56419335929094113911132560272243684991","129683992516956698035414025774403438917","120609988045666988121400073853647420946","325850132597459714713299309192660703042","140087489249634326301456327272266307535"],"threshold":0.9},"id":"ASB-A-461500706-7953c9ef","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/05df4e24983caaf46c9d35d82d5eaa7b7557fbab","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["78139153521333413375691220346111554848","22117557816079280115461150826927296930","22236105038616136280216033962554511711","331192511457113304253531561818596609096"]},"id":"ASB-A-461500706-7cef289c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/61d262e6eecffba83604886470a28e636b3fac5a","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/61d262e6eecffba83604886470a28e636b3fac5a","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java","function":"buildMiniResolver"},"deprecated":false,"digest":{"function_hash":"174458064475516220585128677805942495439","length":910},"id":"ASB-A-461500706-a04db347","signature_type":"Function"},{"id":"ASB-A-461500706-ef700c8a","match_only_versions":["15"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/05df4e24983caaf46c9d35d82d5eaa7b7557fbab","target":{"function":"onCreate","file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false,"digest":{"length":1710,"function_hash":"275600975068241849699869813208466523774"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/da0e8bcdd7faefd6a20db1084f4548f879ff709b","https://android.googlesource.com/platform/frameworks/base/+/a9afcde1ea0991c9e3a64a29a895112af4012d02"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/da0e8bcdd7faefd6a20db1084f4548f879ff709b","target":{"function":"buildMiniResolver","file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false,"digest":{"function_hash":"70802502375059167023747500290520995705","length":850},"id":"ASB-A-461500706-58ffae21","signature_type":"Function"},{"target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false,"digest":{"line_hashes":["78139153521333413375691220346111554848","22117557816079280115461150826927296930","22236105038616136280216033962554511711","331192511457113304253531561818596609096"],"threshold":0.9},"id":"ASB-A-461500706-8bb494b4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/da0e8bcdd7faefd6a20db1084f4548f879ff709b"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a9afcde1ea0991c9e3a64a29a895112af4012d02","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["151257780129023544978963930218942193362","114736881790020246893202071589709360605","113727632206974886353707745357651912544","215030698924241381202671228134672837834","335097099142340031416459041471911055346","136567066977832655758858044248128329832","247047352691011741949288614955118646481","282610005211683422463218026581057951122","290239436913716466994902491240806381237","177209998832725559019748183461050806389","7147032207968402908323949559221056306","56419335929094113911132560272243684991","129683992516956698035414025774403438917","120609988045666988121400073853647420946","325850132597459714713299309192660703042","140087489249634326301456327272266307535"]},"id":"ASB-A-461500706-c1946e8c","match_only_versions":["16"]},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a9afcde1ea0991c9e3a64a29a895112af4012d02","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"275600975068241849699869813208466523774","length":1710},"id":"ASB-A-461500706-ef05c292","match_only_versions":["16"]}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java","function":"buildMiniResolver"},"deprecated":false,"digest":{"function_hash":"70802502375059167023747500290520995705","length":850},"id":"ASB-A-461500706-343519a7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c2a300b19cec96eb1f9d7104a024074638a1489d"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["78139153521333413375691220346111554848","22117557816079280115461150826927296930","22236105038616136280216033962554511711","331192511457113304253531561818596609096"]},"id":"ASB-A-461500706-9423b083","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c2a300b19cec96eb1f9d7104a024074638a1489d","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c2a300b19cec96eb1f9d7104a024074638a1489d"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6354e06830d76c34a05963ac0e3dade4d4bc9969"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["151257780129023544978963930218942193362","114736881790020246893202071589709360605","113727632206974886353707745357651912544","215030698924241381202671228134672837834","335097099142340031416459041471911055346","136567066977832655758858044248128329832","247047352691011741949288614955118646481","282610005211683422463218026581057951122","290239436913716466994902491240806381237","177209998832725559019748183461050806389","7147032207968402908323949559221056306","56419335929094113911132560272243684991","129683992516956698035414025774403438917","120609988045666988121400073853647420946","325850132597459714713299309192660703042","140087489249634326301456327272266307535"]},"id":"ASB-A-461500706-24d3b0b4","match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6354e06830d76c34a05963ac0e3dade4d4bc9969","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"275600975068241849699869813208466523774","length":1710},"id":"ASB-A-461500706-56d0842b","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6354e06830d76c34a05963ac0e3dade4d4bc9969","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java","function":"onCreate"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b30b08cda230cd13bd343bd35857e9c1cd56f0cc","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false,"digest":{"line_hashes":["151257780129023544978963930218942193362","114736881790020246893202071589709360605","113727632206974886353707745357651912544","215030698924241381202671228134672837834","335097099142340031416459041471911055346","136567066977832655758858044248128329832","247047352691011741949288614955118646481","282610005211683422463218026581057951122","290239436913716466994902491240806381237","177209998832725559019748183461050806389","7147032207968402908323949559221056306","56419335929094113911132560272243684991","129683992516956698035414025774403438917","120609988045666988121400073853647420946","325850132597459714713299309192660703042","140087489249634326301456327272266307535"],"threshold":0.9},"id":"ASB-A-461500706-1dd5c6e6","match_only_versions":["14"]},{"digest":{"function_hash":"184516046974447784803309019411650566097","length":2530},"id":"ASB-A-461500706-bfbea1f9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e838f07168599d15409739b25c8f1f21ffdfd219","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java","function":"maybeShowUserConsentMiniResolver"},"deprecated":false},{"target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"},"deprecated":false,"digest":{"line_hashes":["207289286970300325222978528348440114263","43274313884391543354050929222644838433","41738662658140835377580167144017564658","131105229186852075314974234120574923066"],"threshold":0.9},"id":"ASB-A-461500706-c868b5bf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e838f07168599d15409739b25c8f1f21ffdfd219"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/b30b08cda230cd13bd343bd35857e9c1cd56f0cc","target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"153839060791627352531712220202893375938","length":2097},"id":"ASB-A-461500706-e94d97e1","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e838f07168599d15409739b25c8f1f21ffdfd219","https://android.googlesource.com/platform/frameworks/base/+/b30b08cda230cd13bd343bd35857e9c1cd56f0cc"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-461500706.json"}}],"schema_version":"1.9.0"}