{"id":"ASB-A-477024345","details":"In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-477024345","CVE-2026-28620"],"modified":"2026-09-08T15:39:03.104189951Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveActivity"},"deprecated":false,"digest":{"length":3806,"function_hash":"152318689115643783965315851415430113549"},"id":"ASB-A-477024345-32655172","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false,"digest":{"line_hashes":["311931675790667359574614959848407815702","163252509079289346664598790677778443218","81385348547056583696103598749518187225","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","37670851724393402769987267860672672230"],"threshold":0.9},"id":"ASB-A-477024345-3ed1f3e9","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0","target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java"},"deprecated":false,"digest":{"line_hashes":["35569745026013085848239426614272421549","173256776503252644784681834994761176508","194188360801631649423941407410132786513","248475251836087992390790924110843801200","112910424240242112564828443782631983980","44472087015759157047368738032372413949","118605152507255773949623267589271039415","186329621376257576555161691475201072784","64411954336128645573010321346078750655","147890503543006373049841438025174675528","270873643634567871409597883676451149861","335972251913161175978062125401849251240","26222936968821393451451797395371633530","103776494053485082044950756777474764424","293765116076340145545323415283053483909","328829695709924917487563941793712321161"],"threshold":0.9},"id":"ASB-A-477024345-4622895e"},{"deprecated":false,"digest":{"function_hash":"38071842428035955743637239282560935679","length":4720},"id":"ASB-A-477024345-5bf69e4b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0","target":{"function":"startActivities","file":"services/core/java/com/android/server/wm/ActivityStartController.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0","target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java","function":"merge"},"deprecated":false,"digest":{"length":542,"function_hash":"89348211610579307423791110472317762373"},"id":"ASB-A-477024345-a5fe7318","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"line_hashes":["125269627930518898555081884368879613133","178224263307165794426840339082286572912","313681859873681975699662879793020049486","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","129048391759178933727709666415787659955","51404594350926397848415728400378119354","56951790898355548827536525945965240160","47308593454506064418212278157537728877","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","129048391759178933727709666415787659955"],"threshold":0.9},"id":"ASB-A-477024345-fa805f75","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-477024345.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveActivity"},"deprecated":false,"digest":{"function_hash":"283223847655597982080293287674541690965","length":3849},"id":"ASB-A-477024345-14c31a31","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java","function":"startActivities"},"deprecated":false,"digest":{"function_hash":"5778001945956117264740357899042616041","length":5109},"id":"ASB-A-477024345-1e52693b","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["204079113822947347771730577170556123068","172530096293394197421915780989262411","195951391941049641906592842730310883678","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","37670851724393402769987267860672672230"],"threshold":0.9},"id":"ASB-A-477024345-2dd99732","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09","target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["35569745026013085848239426614272421549","173256776503252644784681834994761176508","194188360801631649423941407410132786513","248475251836087992390790924110843801200","112910424240242112564828443782631983980","44472087015759157047368738032372413949","118605152507255773949623267589271039415","186329621376257576555161691475201072784","64411954336128645573010321346078750655","147890503543006373049841438025174675528","270873643634567871409597883676451149861","335972251913161175978062125401849251240","26222936968821393451451797395371633530","103776494053485082044950756777474764424","293765116076340145545323415283053483909","328829695709924917487563941793712321161"]},"id":"ASB-A-477024345-30a2c6f0"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09","target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java","function":"merge"},"deprecated":false,"digest":{"function_hash":"89348211610579307423791110472317762373","length":542},"id":"ASB-A-477024345-5151c8f8","signature_type":"Function"},{"target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["338725473824679195199727831045888689853","178224263307165794426840339082286572912","313681859873681975699662879793020049486","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","129048391759178933727709666415787659955","12154416197711547475059348709956217156","218629848199710159601992890428026474254","44625833088130840786537487043808975684","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","129048391759178933727709666415787659955"]},"id":"ASB-A-477024345-860651a3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-477024345.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveActivity"},"deprecated":false,"digest":{"function_hash":"283223847655597982080293287674541690965","length":3849},"id":"ASB-A-477024345-18621891","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"89348211610579307423791110472317762373","length":542},"id":"ASB-A-477024345-6f04c271","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f","target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java","function":"merge"}},{"digest":{"line_hashes":["35569745026013085848239426614272421549","173256776503252644784681834994761176508","194188360801631649423941407410132786513","248475251836087992390790924110843801200","112910424240242112564828443782631983980","44472087015759157047368738032372413949","118605152507255773949623267589271039415","186329621376257576555161691475201072784","64411954336128645573010321346078750655","147890503543006373049841438025174675528","270873643634567871409597883676451149861","335972251913161175978062125401849251240","26222936968821393451451797395371633530","103776494053485082044950756777474764424","293765116076340145545323415283053483909","328829695709924917487563941793712321161"],"threshold":0.9},"id":"ASB-A-477024345-7017f3d5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f","target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java","function":"startActivities"},"deprecated":false,"digest":{"function_hash":"5778001945956117264740357899042616041","length":5109},"id":"ASB-A-477024345-793be8d3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f"},{"digest":{"line_hashes":["204079113822947347771730577170556123068","172530096293394197421915780989262411","195951391941049641906592842730310883678","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","37670851724393402769987267860672672230"],"threshold":0.9},"id":"ASB-A-477024345-cba76085","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false},{"digest":{"line_hashes":["338725473824679195199727831045888689853","178224263307165794426840339082286572912","313681859873681975699662879793020049486","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","129048391759178933727709666415787659955","12154416197711547475059348709956217156","218629848199710159601992890428026474254","44625833088130840786537487043808975684","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","129048391759178933727709666415787659955"],"threshold":0.9},"id":"ASB-A-477024345-cd089d41","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-477024345.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["35569745026013085848239426614272421549","173256776503252644784681834994761176508","194188360801631649423941407410132786513","248475251836087992390790924110843801200","112910424240242112564828443782631983980","44472087015759157047368738032372413949","118605152507255773949623267589271039415","186329621376257576555161691475201072784","64411954336128645573010321346078750655","147890503543006373049841438025174675528","270873643634567871409597883676451149861","335972251913161175978062125401849251240","26222936968821393451451797395371633530","103776494053485082044950756777474764424","293765116076340145545323415283053483909","328829695709924917487563941793712321161"],"threshold":0.9},"id":"ASB-A-477024345-030acc9d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c","target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c","target":{"function":"merge","file":"services/core/java/com/android/server/uri/NeededUriGrants.java"},"deprecated":false,"digest":{"length":542,"function_hash":"89348211610579307423791110472317762373"},"id":"ASB-A-477024345-3e8c103c"},{"deprecated":false,"digest":{"line_hashes":["125269627930518898555081884368879613133","178224263307165794426840339082286572912","313681859873681975699662879793020049486","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","129048391759178933727709666415787659955","51404594350926397848415728400378119354","56951790898355548827536525945965240160","47308593454506064418212278157537728877","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","129048391759178933727709666415787659955"],"threshold":0.9},"id":"ASB-A-477024345-509c4d4a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java","function":"startActivities"},"deprecated":false,"digest":{"function_hash":"38071842428035955743637239282560935679","length":4720},"id":"ASB-A-477024345-70f6eb42","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c","target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"},"deprecated":false,"digest":{"line_hashes":["311931675790667359574614959848407815702","163252509079289346664598790677778443218","81385348547056583696103598749518187225","153284084378809162492688464036135396280","217949069136231241119266033625709029021","276242586268243559182812891332093382542","37670851724393402769987267860672672230"],"threshold":0.9},"id":"ASB-A-477024345-b80faff8","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c","target":{"function":"resolveActivity","file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"function_hash":"152318689115643783965315851415430113549","length":3806},"id":"ASB-A-477024345-c2ad4e6f","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-477024345.json"}}],"schema_version":"1.9.0"}