{"id":"ASB-A-478725173","details":"In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-478725173","CVE-2026-49912"],"modified":"2026-11-02T17:11:21.181417666Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["ID"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f0b9a17ddc990000d37ee188efe7f729c59a488d","https://android.googlesource.com/platform/frameworks/base/+/1c140dd857ff150a25b881b2f9865714f1b7e0f5"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478725173.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["25526912816802149626935028906252986586","120843264905705818909600373665868038084","217533939607281037218362821411763161247","181783411275619612713634131689990900432"]},"id":"ASB-A-478725173-4bdc656a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/594a0c4e0bd4572dbfabd3caebf7b9f10c822564","target":{"file":"packages/SystemUI/plugin/bcsmartspace/src/com/android/systemui/plugins/BcSmartspaceDataPlugin.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/594a0c4e0bd4572dbfabd3caebf7b9f10c822564"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478725173.json"}},{"package":{"name":"platform/vendor/unbundled_google/packages/SystemUIGoogle","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"fixes":["https://android.googlesource.com/platform/vendor/unbundled_google/packages/SystemUIGoogle/+/bc23c9de8b1015328624b170aa9f86df0d78c499"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478725173.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/719e4ab202cb01492fde54cde75ec5707951e645"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"target":{"file":"packages/SystemUI/plugin/bcsmartspace/src/com/android/systemui/plugins/BcSmartspaceDataPlugin.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["25526912816802149626935028906252986586","120843264905705818909600373665868038084","217533939607281037218362821411763161247","181783411275619612713634131689990900432"]},"id":"ASB-A-478725173-4882aaec","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/719e4ab202cb01492fde54cde75ec5707951e645"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478725173.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"digest":{"line_hashes":["25526912816802149626935028906252986586","120843264905705818909600373665868038084","217533939607281037218362821411763161247","181783411275619612713634131689990900432"],"threshold":0.9},"id":"ASB-A-478725173-3348d8fb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd45468a5cca89f57abb629f7cbf52d7c9a74232","target":{"file":"packages/SystemUI/plugin/bcsmartspace/src/com/android/systemui/plugins/BcSmartspaceDataPlugin.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1f9b329b8a3cade67fa53d276e284d6098d2ee2e","https://android.googlesource.com/platform/frameworks/base/+/cd45468a5cca89f57abb629f7cbf52d7c9a74232"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478725173.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cf7776ba1db241f352ab87b5b1e4ee4f7c60df48","https://android.googlesource.com/platform/frameworks/base/+/66f35422443fe82e6c0a458cb65a3b7ea4094d3b"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478725173.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/130699208524794694b7b3a92311d0beb5f9b6f1","target":{"file":"packages/SystemUI/plugin/bcsmartspace/src/com/android/systemui/plugins/BcSmartspaceDataPlugin.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["25526912816802149626935028906252986586","120843264905705818909600373665868038084","217533939607281037218362821411763161247","181783411275619612713634131689990900432"]},"id":"ASB-A-478725173-06ee6d6a"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/130699208524794694b7b3a92311d0beb5f9b6f1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478725173.json"}},{"package":{"name":"platform/vendor/unbundled_google/packages/SystemUIGoogle","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/vendor/unbundled_google/packages/SystemUIGoogle/+/c02cef6a386e59629c8170087d5c571580e48ecd"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478725173.json"}}],"schema_version":"1.9.2"}