{"id":"ASB-A-466379087","details":"In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-466379087","CVE-2026-28602"],"modified":"2026-09-17T16:10:43.690857626Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/4b3bf7fb29ec6e50bcfb91d96692b4536da195fb"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"digest":{"length":2091,"function_hash":"233742491362047063093620506105486696474"},"id":"ASB-A-466379087-b592e8f5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2198f8cd4baa3c801ca90f1ee2ee976234166df7","target":{"function":"showAccessNotificationLocked","file":"services/core/java/com/android/server/clipboard/ClipboardService.java"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java"},"deprecated":false,"digest":{"line_hashes":["242670269979087310867170809140338113396","101613935930226850328622187841797621000","69004296850171915100929391683260949588","38942589623322858705946114199317356180","70996379334216878621054065891334685875","57111034352889804649869422090926698029","333477182095341389501504633805948974091","283224365462071994002362498697313574372","120011357202005496483387493627460334989","316451330193883793331881727887405735038","340052152065560955247603887075312370109"],"threshold":0.9},"id":"ASB-A-466379087-b8cd6557","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2198f8cd4baa3c801ca90f1ee2ee976234166df7"},{"digest":{"length":626,"function_hash":"217317133435497855471120586631678194266"},"id":"ASB-A-466379087-c24def33","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2198f8cd4baa3c801ca90f1ee2ee976234166df7","target":{"function":"setClipboardAccessNotificationsEnabledForUser","file":"services/core/java/com/android/server/clipboard/ClipboardService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2198f8cd4baa3c801ca90f1ee2ee976234166df7"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379087.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java","function":"showAccessNotificationLocked"},"deprecated":false,"digest":{"length":1858,"function_hash":"31621351572179852981858620279299506344"},"id":"ASB-A-466379087-0427d86a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6de6ab75ea3d8ecbb2a5d8783a0f1de1b4a751d"},{"id":"ASB-A-466379087-0d9ac73e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6de6ab75ea3d8ecbb2a5d8783a0f1de1b4a751d","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java","function":"setClipboardAccessNotificationsEnabledForUser"},"deprecated":false,"digest":{"function_hash":"217317133435497855471120586631678194266","length":626}},{"id":"ASB-A-466379087-439ef4ce","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c6de6ab75ea3d8ecbb2a5d8783a0f1de1b4a751d","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java"},"deprecated":false,"digest":{"line_hashes":["242670269979087310867170809140338113396","101613935930226850328622187841797621000","69004296850171915100929391683260949588","38942589623322858705946114199317356180","70996379334216878621054065891334685875","127365323559514793416883521840427015144","85413592050286356703714025303868190011","283224365462071994002362498697313574372","108577739530743844052623634386990514173","262688454291902316946126506808415591071","161280885800654674579759121587961523511"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c6de6ab75ea3d8ecbb2a5d8783a0f1de1b4a751d"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379087.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5572625867bc3f4bc375129df666bc6d2000053f","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java","function":"setClipboardAccessNotificationsEnabledForUser"},"deprecated":false,"digest":{"function_hash":"217317133435497855471120586631678194266","length":626},"id":"ASB-A-466379087-4b991f74"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5572625867bc3f4bc375129df666bc6d2000053f","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java","function":"showAccessNotificationLocked"},"deprecated":false,"digest":{"length":1904,"function_hash":"121512325153739476397345100497285575923"},"id":"ASB-A-466379087-5e7b8b44"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5572625867bc3f4bc375129df666bc6d2000053f","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java"},"deprecated":false,"digest":{"line_hashes":["242670269979087310867170809140338113396","101613935930226850328622187841797621000","69004296850171915100929391683260949588","38942589623322858705946114199317356180","70996379334216878621054065891334685875","127365323559514793416883521840427015144","85413592050286356703714025303868190011","283224365462071994002362498697313574372","108577739530743844052623634386990514173","262688454291902316946126506808415591071","161280885800654674579759121587961523511"],"threshold":0.9},"id":"ASB-A-466379087-cc8b1e62","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5572625867bc3f4bc375129df666bc6d2000053f"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379087.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/520104cf7f047adea1e987690e9e47589f4ded27","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java","function":"setClipboardAccessNotificationsEnabledForUser"},"deprecated":false,"digest":{"length":626,"function_hash":"217317133435497855471120586631678194266"},"id":"ASB-A-466379087-61188258","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/520104cf7f047adea1e987690e9e47589f4ded27","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["242670269979087310867170809140338113396","101613935930226850328622187841797621000","69004296850171915100929391683260949588","38942589623322858705946114199317356180","70996379334216878621054065891334685875","248163951570550742477559081174320867201","85413592050286356703714025303868190011","283224365462071994002362498697313574372","108577739530743844052623634386990514173","262688454291902316946126506808415591071","161280885800654674579759121587961523511"]},"id":"ASB-A-466379087-731b4632","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/520104cf7f047adea1e987690e9e47589f4ded27","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java","function":"showAccessNotificationLocked"},"deprecated":false,"digest":{"function_hash":"315549041100819815435483627137206038495","length":1943},"id":"ASB-A-466379087-b458e39f"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/520104cf7f047adea1e987690e9e47589f4ded27"],"severity":"High","spl":"2026-09-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379087.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4b3bf7fb29ec6e50bcfb91d96692b4536da195fb"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["242670269979087310867170809140338113396","101613935930226850328622187841797621000","69004296850171915100929391683260949588","38942589623322858705946114199317356180","70996379334216878621054065891334685875","57111034352889804649869422090926698029","333477182095341389501504633805948974091","283224365462071994002362498697313574372","120011357202005496483387493627460334989","316451330193883793331881727887405735038","340052152065560955247603887075312370109"]},"id":"ASB-A-466379087-2107beed","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b3bf7fb29ec6e50bcfb91d96692b4536da195fb","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java"}},{"id":"ASB-A-466379087-4f30ba5d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b3bf7fb29ec6e50bcfb91d96692b4536da195fb","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java","function":"showAccessNotificationLocked"},"deprecated":false,"digest":{"length":2091,"function_hash":"233742491362047063093620506105486696474"}},{"deprecated":false,"digest":{"function_hash":"217317133435497855471120586631678194266","length":626},"id":"ASB-A-466379087-c3f6fe35","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4b3bf7fb29ec6e50bcfb91d96692b4536da195fb","target":{"function":"setClipboardAccessNotificationsEnabledForUser","file":"services/core/java/com/android/server/clipboard/ClipboardService.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379087.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2f5b8b741cde9e05d1a3a8039e3457516953164d"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/2f5b8b741cde9e05d1a3a8039e3457516953164d","target":{"function":"setClipboardAccessNotificationsEnabledForUser","file":"services/core/java/com/android/server/clipboard/ClipboardService.java"},"deprecated":false,"digest":{"length":626,"function_hash":"217317133435497855471120586631678194266"},"id":"ASB-A-466379087-218385b5","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2f5b8b741cde9e05d1a3a8039e3457516953164d","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java","function":"showAccessNotificationLocked"},"deprecated":false,"digest":{"function_hash":"31621351572179852981858620279299506344","length":1858},"id":"ASB-A-466379087-5647e9b5","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2f5b8b741cde9e05d1a3a8039e3457516953164d","target":{"file":"services/core/java/com/android/server/clipboard/ClipboardService.java"},"deprecated":false,"digest":{"line_hashes":["242670269979087310867170809140338113396","101613935930226850328622187841797621000","69004296850171915100929391683260949588","38942589623322858705946114199317356180","70996379334216878621054065891334685875","127365323559514793416883521840427015144","85413592050286356703714025303868190011","283224365462071994002362498697313574372","108577739530743844052623634386990514173","262688454291902316946126506808415591071","161280885800654674579759121587961523511"],"threshold":0.9},"id":"ASB-A-466379087-a9974415"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379087.json"}}],"schema_version":"1.9.0"}