{"id":"ASB-A-475232460","details":"In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-475232460","CVE-2026-28588"],"modified":"2026-11-02T16:56:18.931723189Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/effd5d3048ab0dc5ca5ec22fdf87e6a7685ca424","target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java","function":"shouldBlockDirectoryFromTree"},"deprecated":false,"digest":{"length":501,"function_hash":"82275491147364504503650873122527320830"},"id":"ASB-A-475232460-3ad065b1"},{"digest":{"line_hashes":["83933681243297375959969558404587540873","140183503849517433248087453465657570006","224970194632832193963123257166118880462","30244944761467983056972432635834368099","83540861970962954288406580424248484276","70837494746002368648737333109980752421","208597600751418871290186384987124778971","258002724981554527619314542337768977379"],"threshold":0.9},"id":"ASB-A-475232460-93463e24","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/effd5d3048ab0dc5ca5ec22fdf87e6a7685ca424","target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/effd5d3048ab0dc5ca5ec22fdf87e6a7685ca424"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475232460.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6855695cfc5fd08107c570c0cad696cfbb9ba288","target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"},"deprecated":false,"digest":{"line_hashes":["329654153537445783966023628714573568130","264252585570360469872925622770880012868","307108107232959602058026563594635807119","155279741308028289933410757958509439471","297900573571846313474198597224233988480","326469763656711846424129964613019927926","232856273113549120966216948454444163978","259347481328888458582651227720568894782","83933681243297375959969558404587540873","140183503849517433248087453465657570006","224970194632832193963123257166118880462","30244944761467983056972432635834368099","83540861970962954288406580424248484276","70837494746002368648737333109980752421","208597600751418871290186384987124778971","258002724981554527619314542337768977379","50807490319445686384626557183339780000","49715780295389434497044164315685455083"],"threshold":0.9},"id":"ASB-A-475232460-9db9245c","signature_type":"Line"},{"target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java","function":"shouldBlockDirectoryFromTree"},"deprecated":false,"digest":{"length":501,"function_hash":"82275491147364504503650873122527320830"},"id":"ASB-A-475232460-efaabc71","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6855695cfc5fd08107c570c0cad696cfbb9ba288"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6855695cfc5fd08107c570c0cad696cfbb9ba288"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475232460.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bc4fa785f51c7f450e30d54b75620aa252f9d3cc","target":{"function":"shouldBlockDirectoryFromTree","file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"},"deprecated":false,"digest":{"length":501,"function_hash":"82275491147364504503650873122527320830"},"id":"ASB-A-475232460-1b5f102a","signature_type":"Function"},{"target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["329654153537445783966023628714573568130","264252585570360469872925622770880012868","307108107232959602058026563594635807119","155279741308028289933410757958509439471","297900573571846313474198597224233988480","326469763656711846424129964613019927926","232856273113549120966216948454444163978","259347481328888458582651227720568894782","83933681243297375959969558404587540873","140183503849517433248087453465657570006","224970194632832193963123257166118880462","30244944761467983056972432635834368099","83540861970962954288406580424248484276","70837494746002368648737333109980752421","208597600751418871290186384987124778971","258002724981554527619314542337768977379","50807490319445686384626557183339780000","49715780295389434497044164315685455083"]},"id":"ASB-A-475232460-74cf9dba","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bc4fa785f51c7f450e30d54b75620aa252f9d3cc"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bc4fa785f51c7f450e30d54b75620aa252f9d3cc"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475232460.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5d3a4f9a23101a38191d288af00fe42d2df2d81e","target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"},"deprecated":false,"digest":{"line_hashes":["329654153537445783966023628714573568130","264252585570360469872925622770880012868","307108107232959602058026563594635807119","155279741308028289933410757958509439471","297900573571846313474198597224233988480","326469763656711846424129964613019927926","232856273113549120966216948454444163978","259347481328888458582651227720568894782","83933681243297375959969558404587540873","140183503849517433248087453465657570006","224970194632832193963123257166118880462","30244944761467983056972432635834368099","83540861970962954288406580424248484276","70837494746002368648737333109980752421","208597600751418871290186384987124778971","258002724981554527619314542337768977379","50807490319445686384626557183339780000","49715780295389434497044164315685455083"],"threshold":0.9},"id":"ASB-A-475232460-4988cfbc"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/5d3a4f9a23101a38191d288af00fe42d2df2d81e","target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java","function":"shouldBlockDirectoryFromTree"},"deprecated":false,"digest":{"function_hash":"82275491147364504503650873122527320830","length":501},"id":"ASB-A-475232460-b6860dcc","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5d3a4f9a23101a38191d288af00fe42d2df2d81e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475232460.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e6443b622c9a3febfe166bc2094c8d98aeb037ee"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["329654153537445783966023628714573568130","264252585570360469872925622770880012868","307108107232959602058026563594635807119","155279741308028289933410757958509439471","297900573571846313474198597224233988480","326469763656711846424129964613019927926","232856273113549120966216948454444163978","259347481328888458582651227720568894782","83933681243297375959969558404587540873","140183503849517433248087453465657570006","224970194632832193963123257166118880462","30244944761467983056972432635834368099","83540861970962954288406580424248484276","70837494746002368648737333109980752421","208597600751418871290186384987124778971","258002724981554527619314542337768977379","262535813312078831260059445095950561145","186209304742077193893622636900183857853"]},"id":"ASB-A-475232460-436f7340","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e6443b622c9a3febfe166bc2094c8d98aeb037ee","target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"}},{"digest":{"function_hash":"82275491147364504503650873122527320830","length":501},"id":"ASB-A-475232460-8b3d71ed","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e6443b622c9a3febfe166bc2094c8d98aeb037ee","target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java","function":"shouldBlockDirectoryFromTree"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475232460.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ec094886caf23a8d0495838ae67ab9616194c34b","target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java","function":"shouldBlockDirectoryFromTree"},"deprecated":false,"digest":{"function_hash":"82275491147364504503650873122527320830","length":501},"id":"ASB-A-475232460-9bb6f310"},{"target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"},"deprecated":false,"digest":{"line_hashes":["329654153537445783966023628714573568130","264252585570360469872925622770880012868","307108107232959602058026563594635807119","155279741308028289933410757958509439471","297900573571846313474198597224233988480","326469763656711846424129964613019927926","232856273113549120966216948454444163978","259347481328888458582651227720568894782","83933681243297375959969558404587540873","140183503849517433248087453465657570006","224970194632832193963123257166118880462","30244944761467983056972432635834368099","83540861970962954288406580424248484276","70837494746002368648737333109980752421","208597600751418871290186384987124778971","258002724981554527619314542337768977379","50807490319445686384626557183339780000","49715780295389434497044164315685455083"],"threshold":0.9},"id":"ASB-A-475232460-9d039527","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ec094886caf23a8d0495838ae67ab9616194c34b"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ec094886caf23a8d0495838ae67ab9616194c34b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475232460.json"}}],"schema_version":"1.9.2"}