{"id":"ASB-A-471797062","details":"In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-471797062","CVE-2026-45519"],"modified":"2026-09-17T16:10:43.690857626Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/50d220c204df894fa99ce5016588cd7ff6868dae"}],"affected":[{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-471797062-404cf08e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985","target":{"file":"src/com/android/providers/media/PickerUriResolver.java"},"deprecated":false,"digest":{"line_hashes":["136255459881779733209561662218611934790","294395367568580721154358350653390701654","46704886324711199053884571002473274369","92280561204726612164917428532911013178","149488789888522109969672204370976144719","123714394082864184769197045713019983691","108398568806677337986889258313593990368","115530110639175773067896047472828955136","12969490581236637703291539309192293506","148860207675838887737732496377067494087","59787260834000109755073587214637676915","250927025799556404337369632780213672380","153232267534240168716064683100508580486","231568951080580047518794930010030619265","268626125767758347402833061940876956583","13609415844016869391950478574051330686"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985","target":{"function":"screenArgsForPermissionCheckIfAny","file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"},"deprecated":false,"digest":{"length":590,"function_hash":"264559702129777484324328993580616315011"},"id":"ASB-A-471797062-71dbd3c6","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"},"deprecated":false,"digest":{"line_hashes":["19924643050850108401883855550262439785","170159817407103117438102879015631521666","118460369435563544126036271063373873364","194180163168415881859395927773523052515","92280561204726612164917428532911013178","149488789888522109969672204370976144719","123714394082864184769197045713019983691","281803136071988038811810038568288392263","169354623858565396753326218815789051880","277072968968551115521142189214644226443"],"threshold":0.9},"id":"ASB-A-471797062-c47e7506","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985"},{"deprecated":false,"digest":{"function_hash":"314392134150603790358806780874580300956","length":591},"id":"ASB-A-471797062-e429ab16","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985","target":{"file":"src/com/android/providers/media/PickerUriResolver.java","function":"screenArgsForPermissionCheckIfAny"}}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985"],"severity":"High","spl":"2026-09-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471797062.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"target":{"file":"src/com/android/providers/media/PickerUriResolver.java"},"deprecated":false,"digest":{"line_hashes":["195624920530932057258581649471710216073","258434652752132456608038097898545695380","280545441745195443108241071443220242792","203416457843596201237539545775347676538","136255459881779733209561662218611934790","294395367568580721154358350653390701654","46704886324711199053884571002473274369","92280561204726612164917428532911013178","149488789888522109969672204370976144719","123714394082864184769197045713019983691","108398568806677337986889258313593990368","115530110639175773067896047472828955136","12969490581236637703291539309192293506","242064081025345028933814232958041951599","106365547840900362436021187747521175083","293265090967399996607092831297516822386"],"threshold":0.9},"id":"ASB-A-471797062-7b2b9d27","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c9f7b2e3b05f3bfc64d1175abf410f4f9358a6ba"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c9f7b2e3b05f3bfc64d1175abf410f4f9358a6ba","target":{"function":"screenArgsForPermissionCheckIfAny","file":"src/com/android/providers/media/PickerUriResolver.java"},"deprecated":false,"digest":{"function_hash":"314392134150603790358806780874580300956","length":591},"id":"ASB-A-471797062-945bc965"}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c9f7b2e3b05f3bfc64d1175abf410f4f9358a6ba"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471797062.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"},"deprecated":false,"digest":{"line_hashes":["19924643050850108401883855550262439785","170159817407103117438102879015631521666","118460369435563544126036271063373873364","194180163168415881859395927773523052515","92280561204726612164917428532911013178","149488789888522109969672204370976144719","123714394082864184769197045713019983691","281803136071988038811810038568288392263","169354623858565396753326218815789051880","277072968968551115521142189214644226443"],"threshold":0.9},"id":"ASB-A-471797062-09fe82c2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b"},{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b","target":{"file":"src/com/android/providers/media/PickerUriResolver.java","function":"screenArgsForPermissionCheckIfAny"},"deprecated":false,"digest":{"length":591,"function_hash":"314392134150603790358806780874580300956"},"id":"ASB-A-471797062-5bec9ff1","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-471797062-73e21438","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b","target":{"file":"src/com/android/providers/media/PickerUriResolver.java"},"deprecated":false,"digest":{"line_hashes":["136255459881779733209561662218611934790","294395367568580721154358350653390701654","46704886324711199053884571002473274369","92280561204726612164917428532911013178","149488789888522109969672204370976144719","123714394082864184769197045713019983691","108398568806677337986889258313593990368","115530110639175773067896047472828955136","12969490581236637703291539309192293506","148860207675838887737732496377067494087","59787260834000109755073587214637676915","250927025799556404337369632780213672380","153232267534240168716064683100508580486","231568951080580047518794930010030619265","268626125767758347402833061940876956583","13609415844016869391950478574051330686"],"threshold":0.9}},{"target":{"function":"screenArgsForPermissionCheckIfAny","file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"},"deprecated":false,"digest":{"function_hash":"264559702129777484324328993580616315011","length":590},"id":"ASB-A-471797062-c17f819a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471797062.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9","target":{"file":"src/com/android/providers/media/PickerUriResolver.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["136255459881779733209561662218611934790","294395367568580721154358350653390701654","46704886324711199053884571002473274369","92280561204726612164917428532911013178","149488789888522109969672204370976144719","123714394082864184769197045713019983691","108398568806677337986889258313593990368","115530110639175773067896047472828955136","12969490581236637703291539309192293506","148860207675838887737732496377067494087","59787260834000109755073587214637676915","250927025799556404337369632780213672380","153232267534240168716064683100508580486","231568951080580047518794930010030619265","268626125767758347402833061940876956583","13609415844016869391950478574051330686"]},"id":"ASB-A-471797062-7e7d6514","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"314392134150603790358806780874580300956","length":591},"id":"ASB-A-471797062-90d4e6eb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9","target":{"file":"src/com/android/providers/media/PickerUriResolver.java","function":"screenArgsForPermissionCheckIfAny"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9","target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["19924643050850108401883855550262439785","170159817407103117438102879015631521666","118460369435563544126036271063373873364","194180163168415881859395927773523052515","92280561204726612164917428532911013178","149488789888522109969672204370976144719","123714394082864184769197045713019983691","281803136071988038811810038568288392263","169354623858565396753326218815789051880","277072968968551115521142189214644226443"]},"id":"ASB-A-471797062-c252da75"},{"deprecated":false,"digest":{"length":590,"function_hash":"264559702129777484324328993580616315011"},"id":"ASB-A-471797062-d1782182","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9","target":{"function":"screenArgsForPermissionCheckIfAny","file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"}}],"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9"],"severity":"High","spl":"2026-09-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471797062.json"}},{"package":{"name":"platform/packages/providers/MediaProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"264559702129777484324328993580616315011","length":590},"id":"ASB-A-471797062-21f9e8ea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c","target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java","function":"screenArgsForPermissionCheckIfAny"}},{"target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"},"deprecated":false,"digest":{"line_hashes":["19924643050850108401883855550262439785","170159817407103117438102879015631521666","118460369435563544126036271063373873364","194180163168415881859395927773523052515","92280561204726612164917428532911013178","149488789888522109969672204370976144719","123714394082864184769197045713019983691","281803136071988038811810038568288392263","169354623858565396753326218815789051880","277072968968551115521142189214644226443"],"threshold":0.9},"id":"ASB-A-471797062-3b6b2c21","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c"},{"deprecated":false,"digest":{"function_hash":"314392134150603790358806780874580300956","length":591},"id":"ASB-A-471797062-829b9d05","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c","target":{"function":"screenArgsForPermissionCheckIfAny","file":"src/com/android/providers/media/PickerUriResolver.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c","target":{"file":"src/com/android/providers/media/PickerUriResolver.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["136255459881779733209561662218611934790","294395367568580721154358350653390701654","46704886324711199053884571002473274369","92280561204726612164917428532911013178","149488789888522109969672204370976144719","123714394082864184769197045713019983691","108398568806677337986889258313593990368","115530110639175773067896047472828955136","12969490581236637703291539309192293506","148860207675838887737732496377067494087","59787260834000109755073587214637676915","250927025799556404337369632780213672380","153232267534240168716064683100508580486","231568951080580047518794930010030619265","268626125767758347402833061940876956583","13609415844016869391950478574051330686"]},"id":"ASB-A-471797062-996c5382"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471797062.json"}}],"schema_version":"1.9.0"}