{"id":"ASB-A-466379326","details":"In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-466379326","CVE-2026-28645"],"modified":"2026-11-02T17:11:10.681366972Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"services/usb/java/com/android/server/usb/UsbService.java","function":"onStrongAuthRequiredChanged"},"deprecated":false,"digest":{"length":379,"function_hash":"154425220503887926437955666012319712863"},"id":"ASB-A-466379326-4951796b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d1d84790170ed14a43e94916b2a72705a28ed120"},{"digest":{"function_hash":"329843847068552324655743178063563805308","length":68},"id":"ASB-A-466379326-726ad265","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d1d84790170ed14a43e94916b2a72705a28ed120","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java","function":"StrongAuthTracker"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["14135717664980774877326940435207113668","208838257019120888967029492057812988734","303980997206777082058236167758998550078","258246696498638717619289475853458000045","246551343149370064425642235722156218478","83469962468524913589845419853553986518","47659304363336278112407531927013924706","69354891173357740875382065604565404025","65732332423169984516154460319704600921","281539077955874376535633721848932842277","201361504904559087994707938912319911071","14453627472059716073492930783196928421","142908405981069175745047548176438908229","313787326944162827791376250620130931150","106024859502867110267419687826994238575","209913841649926796741846809279602232275","298090012230477056240749392424569058539","146191834689988354582861061796100917605","12102003753047298497756989403829790547","288536425967749295275228198138937206395","123259814890229235172367641832624658585","313895290493904623434744421914978062168","74413670498046396838933548594788388058","208117407908900600207618631210575715878","185314699748882036841895225554119519059"],"threshold":0.9},"id":"ASB-A-466379326-cbe4a67c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d1d84790170ed14a43e94916b2a72705a28ed120","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d1d84790170ed14a43e94916b2a72705a28ed120"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379326.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0948da33412d71d92ff492f020ce7ed969b81dc3"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-466379326-26ac7e83","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0948da33412d71d92ff492f020ce7ed969b81dc3","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"},"deprecated":false,"digest":{"line_hashes":["102241572269453843460507618342099680170","208582032463455965507622451425207455213","38898817695566244028862529412608167728","286926626640485404869481602976069826770","293576382477151733515474328048855001981","321550460456259090372856488170391641133","138563494391990683285167269512389119437","303980997206777082058236167758998550078","258246696498638717619289475853458000045","246551343149370064425642235722156218478","296342631543126687628208183122482609900","68159535893293199116900970964224433832","102492766261531378121582706954893243587","201361504904559087994707938912319911071","14453627472059716073492930783196928421","142908405981069175745047548176438908229","313787326944162827791376250620130931150","106024859502867110267419687826994238575","209913841649926796741846809279602232275","298090012230477056240749392424569058539","266060926842948814330620359542701948143","236126259269540262345731845388030952395","301149630119402721933085596143639699477","198485790475347994814906935949157507616","118615365018110428008084428017238467684"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"153934195309772974872074535054637388342","length":359},"id":"ASB-A-466379326-533e8f53","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0948da33412d71d92ff492f020ce7ed969b81dc3","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java","function":"onStrongAuthRequiredChanged"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/0948da33412d71d92ff492f020ce7ed969b81dc3","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java","function":"StrongAuthTracker"},"deprecated":false,"digest":{"length":68,"function_hash":"329843847068552324655743178063563805308"},"id":"ASB-A-466379326-a63242a0","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379326.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["101618585289182684857354010888673946506","109673027652773160251131906237311162554","104068313783911841467637249532174009283","307337615482527339798194465528826848013","14135717664980774877326940435207113668","208838257019120888967029492057812988734","303980997206777082058236167758998550078","258246696498638717619289475853458000045","246551343149370064425642235722156218478","296342631543126687628208183122482609900","68159535893293199116900970964224433832","102492766261531378121582706954893243587","201361504904559087994707938912319911071","14453627472059716073492930783196928421","142908405981069175745047548176438908229","313787326944162827791376250620130931150","106024859502867110267419687826994238575","209913841649926796741846809279602232275","298090012230477056240749392424569058539","146191834689988354582861061796100917605","12102003753047298497756989403829790547","165738275013058604175747402476153113074","50765511494851665447417845033293331796","318764030193275878688521655056416273090","193674767731532334346029463426109540076","320893116675993848067962957191224473875","185314699748882036841895225554119519059"]},"id":"ASB-A-466379326-01b4d059","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fea130396d83cf4fcf931880fe86acc384ecfb20"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fea130396d83cf4fcf931880fe86acc384ecfb20","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java","function":"onStrongAuthRequiredChanged"},"deprecated":false,"digest":{"length":404,"function_hash":"104120188869158194378484268374750053020"},"id":"ASB-A-466379326-28f449c5"},{"id":"ASB-A-466379326-d8cf10cc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fea130396d83cf4fcf931880fe86acc384ecfb20","target":{"function":"StrongAuthTracker","file":"services/usb/java/com/android/server/usb/UsbService.java"},"deprecated":false,"digest":{"function_hash":"329843847068552324655743178063563805308","length":68}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fea130396d83cf4fcf931880fe86acc384ecfb20"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379326.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-466379326-7e8edf88","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/552f2ccadd3f8a30867150393afa5702886b9f30","target":{"function":"onStrongAuthRequiredChanged","file":"services/usb/java/com/android/server/usb/UsbService.java"},"deprecated":false,"digest":{"function_hash":"154425220503887926437955666012319712863","length":379}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/552f2ccadd3f8a30867150393afa5702886b9f30","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java","function":"StrongAuthTracker"},"deprecated":false,"digest":{"length":68,"function_hash":"329843847068552324655743178063563805308"},"id":"ASB-A-466379326-de9c4b76"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/552f2ccadd3f8a30867150393afa5702886b9f30","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["14135717664980774877326940435207113668","208838257019120888967029492057812988734","303980997206777082058236167758998550078","258246696498638717619289475853458000045","246551343149370064425642235722156218478","83469962468524913589845419853553986518","47659304363336278112407531927013924706","69354891173357740875382065604565404025","65732332423169984516154460319704600921","281539077955874376535633721848932842277","201361504904559087994707938912319911071","14453627472059716073492930783196928421","142908405981069175745047548176438908229","313787326944162827791376250620130931150","106024859502867110267419687826994238575","209913841649926796741846809279602232275","298090012230477056240749392424569058539","146191834689988354582861061796100917605","12102003753047298497756989403829790547","288536425967749295275228198138937206395","123259814890229235172367641832624658585","313895290493904623434744421914978062168","74413670498046396838933548594788388058","208117407908900600207618631210575715878","185314699748882036841895225554119519059"]},"id":"ASB-A-466379326-f2fe464f","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/552f2ccadd3f8a30867150393afa5702886b9f30"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379326.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"length":68,"function_hash":"329843847068552324655743178063563805308"},"id":"ASB-A-466379326-737ff0ed","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fa49f9f4ba37a8c65c27cc03ff1718abc6fc32b5","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java","function":"StrongAuthTracker"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fa49f9f4ba37a8c65c27cc03ff1718abc6fc32b5","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java","function":"onStrongAuthRequiredChanged"},"deprecated":false,"digest":{"function_hash":"154425220503887926437955666012319712863","length":379},"id":"ASB-A-466379326-f2fda996","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["14135717664980774877326940435207113668","208838257019120888967029492057812988734","303980997206777082058236167758998550078","258246696498638717619289475853458000045","246551343149370064425642235722156218478","83469962468524913589845419853553986518","47659304363336278112407531927013924706","69354891173357740875382065604565404025","65732332423169984516154460319704600921","281539077955874376535633721848932842277","201361504904559087994707938912319911071","14453627472059716073492930783196928421","142908405981069175745047548176438908229","313787326944162827791376250620130931150","106024859502867110267419687826994238575","209913841649926796741846809279602232275","298090012230477056240749392424569058539","146191834689988354582861061796100917605","12102003753047298497756989403829790547","288536425967749295275228198138937206395","123259814890229235172367641832624658585","313895290493904623434744421914978062168","74413670498046396838933548594788388058","208117407908900600207618631210575715878","185314699748882036841895225554119519059"]},"id":"ASB-A-466379326-fef522ed","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fa49f9f4ba37a8c65c27cc03ff1718abc6fc32b5","target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fa49f9f4ba37a8c65c27cc03ff1718abc6fc32b5"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-466379326.json"}}],"schema_version":"1.9.2"}