{"id":"ASB-A-471796626","details":"In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-471796626","CVE-2026-28634"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/services/Telephony/+/5ef227b0a2f76cdc6f4c8596897e04adf7edf225"}],"affected":[{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/b76670f3c5ba3d8ad156de232aff09289fe49e26","target":{"file":"src/com/android/phone/PhoneInterfaceManager.java","function":"handleUssdRequest"},"deprecated":false,"digest":{"length":428,"function_hash":"222337894208834175636102186681021308661"},"id":"ASB-A-471796626-22db06b9","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/b76670f3c5ba3d8ad156de232aff09289fe49e26","target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"},"deprecated":false,"digest":{"line_hashes":["186919473631449760039227607004663883894","114269787940673790174152819488750659068","177151352633643644205142993540594464916"],"threshold":0.9},"id":"ASB-A-471796626-86d2e6de","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/b76670f3c5ba3d8ad156de232aff09289fe49e26"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471796626.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/28ada8352466d0256eb243747db96f29ced9641f"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/28ada8352466d0256eb243747db96f29ced9641f","target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["186919473631449760039227607004663883894","114269787940673790174152819488750659068","177151352633643644205142993540594464916"]},"id":"ASB-A-471796626-7e0a5b6f","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/services/Telephony/+/28ada8352466d0256eb243747db96f29ced9641f","target":{"file":"src/com/android/phone/PhoneInterfaceManager.java","function":"handleUssdRequest"},"deprecated":false,"digest":{"length":428,"function_hash":"222337894208834175636102186681021308661"},"id":"ASB-A-471796626-8494315d","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471796626.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/phone/PhoneInterfaceManager.java","function":"handleUssdRequest"},"deprecated":false,"digest":{"function_hash":"222337894208834175636102186681021308661","length":428},"id":"ASB-A-471796626-be3516fe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/5bbb1d01fff709247feb0ba009858b3f171eda33"},{"target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"},"deprecated":false,"digest":{"line_hashes":["186919473631449760039227607004663883894","114269787940673790174152819488750659068","177151352633643644205142993540594464916"],"threshold":0.9},"id":"ASB-A-471796626-d61f31c3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/5bbb1d01fff709247feb0ba009858b3f171eda33"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/5bbb1d01fff709247feb0ba009858b3f171eda33"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471796626.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/phone/PhoneInterfaceManager.java","function":"handleUssdRequest"},"deprecated":false,"digest":{"function_hash":"222337894208834175636102186681021308661","length":428},"id":"ASB-A-471796626-6b82d4da","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/ef9e639eafb30559161b1a5856b1ff0217338373"},{"digest":{"line_hashes":["186919473631449760039227607004663883894","114269787940673790174152819488750659068","177151352633643644205142993540594464916"],"threshold":0.9},"id":"ASB-A-471796626-afca8bd5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/ef9e639eafb30559161b1a5856b1ff0217338373","target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/ef9e639eafb30559161b1a5856b1ff0217338373"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471796626.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/1336ed741dc401c0d8992eaf7bdb2993e7980216","target":{"function":"handleUssdRequest","file":"src/com/android/phone/PhoneInterfaceManager.java"},"deprecated":false,"digest":{"function_hash":"222337894208834175636102186681021308661","length":428},"id":"ASB-A-471796626-aef2114b","signature_type":"Function"},{"digest":{"line_hashes":["186919473631449760039227607004663883894","114269787940673790174152819488750659068","177151352633643644205142993540594464916"],"threshold":0.9},"id":"ASB-A-471796626-d9050b73","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/1336ed741dc401c0d8992eaf7bdb2993e7980216","target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/1336ed741dc401c0d8992eaf7bdb2993e7980216"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471796626.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/863d637733d85660319688c88cca0c3513f432a9","target":{"file":"src/com/android/phone/PhoneInterfaceManager.java","function":"handleUssdRequest"},"deprecated":false,"digest":{"function_hash":"305903702553705511918434832373802383297","length":328},"id":"ASB-A-471796626-6a70c3cc"},{"id":"ASB-A-471796626-98f968f4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/863d637733d85660319688c88cca0c3513f432a9","target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["128005657640396041656347709280993036307","147241768871935847911590844890905890184","290790585827739953921811939536942928386"]}}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/863d637733d85660319688c88cca0c3513f432a9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471796626.json"}}],"schema_version":"1.9.0"}