{"id":"ASB-A-473814675","details":"In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-473814675","CVE-2026-0084"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"307306498109203122948322537838215800761","length":713},"id":"ASB-A-473814675-1cf865c9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"unbindServiceIfNeededLocked"}},{"digest":{"line_hashes":["32916723925632318774299212725510119998","23465703901109145808070033521243449922","27074621150207393466112425325617462379","278192926761753424587106581378240049629","94191613873949150973081755475584323077","173068256567675514713721637381528454459","256067101529890981159102112154481844784","266006951096580694214259099408002940696","205033917680389892942356032010261995008","180242617872509661209655221367717215698","154558351122561472081162410037952380884","52637053039034779991475866448153655851","48750494594910239388672805466368974054","95332332791951369099579818254854543664","54641944154349474374140373142669916394","213408842048918346247549120204071575202","236629189440246271617986640990559865774","139388628554035034461246132277920728899","177674149891137280774393486567163277463","20209024432163955890111178053820901147","92210813461598043500546680177868128967","324796329057189940513036913132971346812","122655996882589398941049316572214181585","44034718097019716667676964917304335937","217440627658852519073481743159565701711","23437164819922502552514580924002030427","97296571701981812174850137143837846234","302463261408426082452619241468575048348","284901402231722898802864401025636069074","77451213172031023835549673663606374291","30837802114692911668435351510048138437","329846614121192265050548696624380154529","75359969764965975072068991768790728022","258864385201942430195220001622672889735","103239287560605372200313922842440123325","88384007256271835668450122460948718419","155595283141879195238343321405519120733","54216206314338370435003253701142911133","12158097515406970619246323944090638097","179936530091154085180439514123287570670","183664819523193451429488277827647457664","65041775798212110474632731902588482060","77049163206267300173859525311079167067","160366424869744482228520351923117736751","121403439584687912447768080149365310609","146980110866547170052715400937635311602","106389199246654423351681598392121197241","299274195767484732676569315662222910418"],"threshold":0.9},"id":"ASB-A-473814675-6258603b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onBindingDied"},"deprecated":false,"digest":{"length":102,"function_hash":"305091786940368283214673959004810110189"},"id":"ASB-A-473814675-66aa4e9e","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f","target":{"function":"unbindInactiveServicesLocked","file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"digest":{"length":678,"function_hash":"199352943883854230378010914782653536497"},"id":"ASB-A-473814675-87e74a2a","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onPreferredForegroundServiceChanged"},"deprecated":false,"digest":{"function_hash":"256090902513176896471564293279583413352","length":473},"id":"ASB-A-473814675-e10db742","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-473814675.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"305091786940368283214673959004810110189","length":102},"id":"ASB-A-473814675-26655b0d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/44f9a3b107be2185f366e85ef0215606e3b57f16","target":{"function":"onBindingDied","file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"}},{"digest":{"length":678,"function_hash":"199352943883854230378010914782653536497"},"id":"ASB-A-473814675-5b24d15b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb","target":{"function":"unbindInactiveServicesLocked","file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"unbindServiceIfNeededLocked"},"deprecated":false,"digest":{"length":713,"function_hash":"307306498109203122948322537838215800761"},"id":"ASB-A-473814675-61ce63c3","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/44f9a3b107be2185f366e85ef0215606e3b57f16","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"digest":{"line_hashes":["121403439584687912447768080149365310609","146980110866547170052715400937635311602","106389199246654423351681598392121197241","299274195767484732676569315662222910418"],"threshold":0.9},"id":"ASB-A-473814675-9beaf865","signature_type":"Line"},{"id":"ASB-A-473814675-e2cd71ce","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"digest":{"line_hashes":["50428217262205589717793303943962234049","283809765770388058340367956760258520701","15334545613834930763439853215230945047","278192926761753424587106581378240049629","94191613873949150973081755475584323077","173068256567675514713721637381528454459","256067101529890981159102112154481844784","266006951096580694214259099408002940696","205033917680389892942356032010261995008","180242617872509661209655221367717215698","154558351122561472081162410037952380884","52637053039034779991475866448153655851","48750494594910239388672805466368974054","95332332791951369099579818254854543664","54641944154349474374140373142669916394","213408842048918346247549120204071575202","236629189440246271617986640990559865774","139388628554035034461246132277920728899","177674149891137280774393486567163277463","20209024432163955890111178053820901147","92210813461598043500546680177868128967","324796329057189940513036913132971346812","122655996882589398941049316572214181585","44034718097019716667676964917304335937","217440627658852519073481743159565701711","23437164819922502552514580924002030427","97296571701981812174850137143837846234","302463261408426082452619241468575048348","284901402231722898802864401025636069074","77451213172031023835549673663606374291","30837802114692911668435351510048138437","329846614121192265050548696624380154529","75359969764965975072068991768790728022","258864385201942430195220001622672889735","103239287560605372200313922842440123325","88384007256271835668450122460948718419","155595283141879195238343321405519120733","54216206314338370435003253701142911133","12158097515406970619246323944090638097","179936530091154085180439514123287570670","183664819523193451429488277827647457664","65041775798212110474632731902588482060","77049163206267300173859525311079167067","160366424869744482228520351923117736751"],"threshold":0.9}},{"target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onPreferredForegroundServiceChanged"},"deprecated":false,"digest":{"length":368,"function_hash":"150071831528752995632003707593280758522"},"id":"ASB-A-473814675-f96b9b73","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb","https://android.googlesource.com/platform/packages/modules/Nfc/+/f6fc44fac696ab4ef6d148986443b9a47afc78a2","https://android.googlesource.com/platform/packages/modules/Nfc/+/44f9a3b107be2185f366e85ef0215606e3b57f16"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-473814675.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6","https://android.googlesource.com/platform/packages/modules/Nfc/+/2d4b7ed433917f2146cbb1043b739eb8f96c0f09","https://android.googlesource.com/platform/packages/modules/Nfc/+/238fdb247a8d5ea75638e5b90a9ef3ef481f26e6"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/238fdb247a8d5ea75638e5b90a9ef3ef481f26e6","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onBindingDied"},"deprecated":false,"digest":{"function_hash":"305091786940368283214673959004810110189","length":102},"id":"ASB-A-473814675-253bf072"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onPreferredForegroundServiceChanged"},"deprecated":false,"digest":{"function_hash":"256090902513176896471564293279583413352","length":473},"id":"ASB-A-473814675-29331a15","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"199352943883854230378010914782653536497","length":678},"id":"ASB-A-473814675-32c1535f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"unbindInactiveServicesLocked"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6","target":{"function":"unbindServiceIfNeededLocked","file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"digest":{"function_hash":"307306498109203122948322537838215800761","length":713},"id":"ASB-A-473814675-3ce2f0fa","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/238fdb247a8d5ea75638e5b90a9ef3ef481f26e6","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"digest":{"line_hashes":["121403439584687912447768080149365310609","146980110866547170052715400937635311602","106389199246654423351681598392121197241","299274195767484732676569315662222910418"],"threshold":0.9},"id":"ASB-A-473814675-978be848","signature_type":"Line"},{"id":"ASB-A-473814675-9df2303e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["32916723925632318774299212725510119998","23465703901109145808070033521243449922","27074621150207393466112425325617462379","278192926761753424587106581378240049629","94191613873949150973081755475584323077","173068256567675514713721637381528454459","256067101529890981159102112154481844784","266006951096580694214259099408002940696","205033917680389892942356032010261995008","180242617872509661209655221367717215698","154558351122561472081162410037952380884","52637053039034779991475866448153655851","48750494594910239388672805466368974054","95332332791951369099579818254854543664","54641944154349474374140373142669916394","213408842048918346247549120204071575202","236629189440246271617986640990559865774","139388628554035034461246132277920728899","177674149891137280774393486567163277463","20209024432163955890111178053820901147","92210813461598043500546680177868128967","324796329057189940513036913132971346812","122655996882589398941049316572214181585","44034718097019716667676964917304335937","217440627658852519073481743159565701711","23437164819922502552514580924002030427","97296571701981812174850137143837846234","302463261408426082452619241468575048348","284901402231722898802864401025636069074","77451213172031023835549673663606374291","30837802114692911668435351510048138437","329846614121192265050548696624380154529","75359969764965975072068991768790728022","258864385201942430195220001622672889735","103239287560605372200313922842440123325","88384007256271835668450122460948718419","155595283141879195238343321405519120733","54216206314338370435003253701142911133","12158097515406970619246323944090638097","179936530091154085180439514123287570670","183664819523193451429488277827647457664","65041775798212110474632731902588482060","77049163206267300173859525311079167067","160366424869744482228520351923117736751"]}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-473814675.json"}}],"schema_version":"1.9.0"}