{"id":"ASB-A-475542441","details":"In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-475542441","CVE-2026-28612"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["80397874819914435962287995189429353279","324869342438177983429542822815814803635","33402783348378538749849599688089551584","198819044329240885950294912553429500532","77085443262448550127383596857662322331","212192366188771760189339415757557208188","53865122812802975109679423727452725434","125981947974766921488540001279500083414","201770805904630782353555982116669700691","264599426912119222982544240821614659420","189141642157816828296152565283176316292","124537554651593874843128017938572052325","7450090752167862960006447653757967239","34927843616474237649522512679983462444","57700655952896568908631876239598985640","198015338095479692361873197064248404950"]},"id":"ASB-A-475542441-4ca3caab"},{"deprecated":false,"digest":{"function_hash":"152318689115643783965315851415430113549","length":3806},"id":"ASB-A-475542441-6bb1ab40","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveActivity"}},{"deprecated":false,"digest":{"function_hash":"38071842428035955743637239282560935679","length":4720},"id":"ASB-A-475542441-75556df6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java","function":"startActivities"}},{"id":"ASB-A-475542441-fc8d6842","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"line_hashes":["325917412571960559806126044957144615378","253302707306192844154826311543182663588","86405427633677763232192497837533324472","189699288453370789495197806146032801016","297518760508301895902510879832999055580","337597234209694277940537694039608318580","329389155866721868791704832052920768272","282863183023824702358406795703522283096","130130167180154615443060466846737541997","211792142800539105703932329430569283144","178266103278669671856588323618706586269","295539928809912818928136327791533605105","78582916131776485440030767200248866074","189197256195804816283729717437234652939","149268927962259120998306307305489256989","113325408472494198665526707802296386374","148164836224747363588314045789274849445","324230526512426163353082979198179157586","167372610395889717606324395043224027605","37946721957814839870797236343900513553"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475542441.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-475542441-1d14a9cc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveActivity"},"deprecated":false,"digest":{"length":3849,"function_hash":"186982109334638526793663879095329947989"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"line_hashes":["325917412571960559806126044957144615378","253302707306192844154826311543182663588","86405427633677763232192497837533324472","189699288453370789495197806146032801016","297518760508301895902510879832999055580","337597234209694277940537694039608318580","329389155866721868791704832052920768272","282863183023824702358406795703522283096","130130167180154615443060466846737541997","211792142800539105703932329430569283144","178266103278669671856588323618706586269","295539928809912818928136327791533605105","78582916131776485440030767200248866074","189197256195804816283729717437234652939","149268927962259120998306307305489256989","113325408472494198665526707802296386374","148164836224747363588314045789274849445","324230526512426163353082979198179157586","167372610395889717606324395043224027605","37946721957814839870797236343900513553"],"threshold":0.9},"id":"ASB-A-475542441-47d54763"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false,"digest":{"line_hashes":["80397874819914435962287995189429353279","324869342438177983429542822815814803635","33402783348378538749849599688089551584","198819044329240885950294912553429500532","77085443262448550127383596857662322331","212192366188771760189339415757557208188","53865122812802975109679423727452725434","125981947974766921488540001279500083414","201770805904630782353555982116669700691","264599426912119222982544240821614659420","189141642157816828296152565283176316292","124537554651593874843128017938572052325","7450090752167862960006447653757967239","34927843616474237649522512679983462444","57700655952896568908631876239598985640","198015338095479692361873197064248404950"],"threshold":0.9},"id":"ASB-A-475542441-e10a4a25","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8","target":{"function":"startActivities","file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false,"digest":{"length":4747,"function_hash":"50496487256533071234918033827480579586"},"id":"ASB-A-475542441-f2b3c28a","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475542441.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveActivity"},"deprecated":false,"digest":{"function_hash":"186982109334638526793663879095329947989","length":3849},"id":"ASB-A-475542441-52dce7e0","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false,"digest":{"line_hashes":["80397874819914435962287995189429353279","324869342438177983429542822815814803635","33402783348378538749849599688089551584","198819044329240885950294912553429500532","77085443262448550127383596857662322331","212192366188771760189339415757557208188","53865122812802975109679423727452725434","125981947974766921488540001279500083414","201770805904630782353555982116669700691","264599426912119222982544240821614659420","189141642157816828296152565283176316292","124537554651593874843128017938572052325","7450090752167862960006447653757967239","34927843616474237649522512679983462444","57700655952896568908631876239598985640","198015338095479692361873197064248404950"],"threshold":0.9},"id":"ASB-A-475542441-a4a0ead6","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["325917412571960559806126044957144615378","253302707306192844154826311543182663588","86405427633677763232192497837533324472","189699288453370789495197806146032801016","297518760508301895902510879832999055580","337597234209694277940537694039608318580","329389155866721868791704832052920768272","282863183023824702358406795703522283096","130130167180154615443060466846737541997","211792142800539105703932329430569283144","178266103278669671856588323618706586269","295539928809912818928136327791533605105","78582916131776485440030767200248866074","189197256195804816283729717437234652939","149268927962259120998306307305489256989","113325408472494198665526707802296386374","148164836224747363588314045789274849445","324230526512426163353082979198179157586","167372610395889717606324395043224027605","37946721957814839870797236343900513553"]},"id":"ASB-A-475542441-b1d48f17","signature_type":"Line"},{"digest":{"function_hash":"50496487256533071234918033827480579586","length":4747},"id":"ASB-A-475542441-f6a0a54d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475","target":{"function":"startActivities","file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475542441.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43","target":{"function":"startActivities","file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false,"digest":{"function_hash":"38071842428035955743637239282560935679","length":4720},"id":"ASB-A-475542441-6865d39f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43","target":{"function":"resolveActivity","file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"function_hash":"152318689115643783965315851415430113549","length":3806},"id":"ASB-A-475542441-70cd8251","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"line_hashes":["325917412571960559806126044957144615378","253302707306192844154826311543182663588","86405427633677763232192497837533324472","189699288453370789495197806146032801016","297518760508301895902510879832999055580","337597234209694277940537694039608318580","329389155866721868791704832052920768272","282863183023824702358406795703522283096","130130167180154615443060466846737541997","211792142800539105703932329430569283144","178266103278669671856588323618706586269","295539928809912818928136327791533605105","78582916131776485440030767200248866074","189197256195804816283729717437234652939","149268927962259120998306307305489256989","113325408472494198665526707802296386374","148164836224747363588314045789274849445","324230526512426163353082979198179157586","167372610395889717606324395043224027605","37946721957814839870797236343900513553"],"threshold":0.9},"id":"ASB-A-475542441-cab10468"},{"deprecated":false,"digest":{"line_hashes":["80397874819914435962287995189429353279","324869342438177983429542822815814803635","33402783348378538749849599688089551584","198819044329240885950294912553429500532","77085443262448550127383596857662322331","212192366188771760189339415757557208188","53865122812802975109679423727452725434","125981947974766921488540001279500083414","201770805904630782353555982116669700691","264599426912119222982544240821614659420","189141642157816828296152565283176316292","124537554651593874843128017938572052325","7450090752167862960006447653757967239","34927843616474237649522512679983462444","57700655952896568908631876239598985640","198015338095479692361873197064248404950"],"threshold":0.9},"id":"ASB-A-475542441-ce023634","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-475542441.json"}}],"schema_version":"1.9.0"}