{"id":"ASB-A-478861451","details":"In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-478861451","CVE-2026-58970"],"modified":"2026-11-02T16:56:19.908199225Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java","function":"deliverResult"},"deprecated":false,"digest":{"function_hash":"42545786270948247939115694997330856300","length":587},"id":"ASB-A-478861451-2b291160","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/572a9e0a14c569535b351c314ddca9e45d0e635b"},{"digest":{"line_hashes":["95684936663425227581478169629733210733","78271862597757234866865187883678106689","86553225653796865187660634682691417360","83045942880306541814562217583650842310","115941277113593138183873853884904520287","179216725968750459647782714189745461208"],"threshold":0.9},"id":"ASB-A-478861451-5be02450","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/572a9e0a14c569535b351c314ddca9e45d0e635b","target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/572a9e0a14c569535b351c314ddca9e45d0e635b"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478861451.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d8c9f5c1764ffe5379784c5f81d20f127afeb971","target":{"function":"deliverResult","file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false,"digest":{"function_hash":"42545786270948247939115694997330856300","length":587},"id":"ASB-A-478861451-549e2738","signature_type":"Function"},{"target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false,"digest":{"line_hashes":["95684936663425227581478169629733210733","78271862597757234866865187883678106689","86553225653796865187660634682691417360","83045942880306541814562217583650842310","115941277113593138183873853884904520287","179216725968750459647782714189745461208"],"threshold":0.9},"id":"ASB-A-478861451-bc84fa4c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d8c9f5c1764ffe5379784c5f81d20f127afeb971"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d8c9f5c1764ffe5379784c5f81d20f127afeb971"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478861451.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-478861451-4cf69313","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b4f296b6bdfc626f90c1dca4f1029f31eb48f8eb","target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false,"digest":{"line_hashes":["95684936663425227581478169629733210733","78271862597757234866865187883678106689","86553225653796865187660634682691417360","83045942880306541814562217583650842310","115941277113593138183873853884904520287","179216725968750459647782714189745461208"],"threshold":0.9}},{"digest":{"function_hash":"42545786270948247939115694997330856300","length":587},"id":"ASB-A-478861451-999dbf73","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b4f296b6bdfc626f90c1dca4f1029f31eb48f8eb","target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java","function":"deliverResult"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b4f296b6bdfc626f90c1dca4f1029f31eb48f8eb"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478861451.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-478861451-1796b313","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8f46aae1853c0b9a5d5b2ae5b2c6547f9c45458e","target":{"function":"deliverResult","file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false,"digest":{"length":587,"function_hash":"42545786270948247939115694997330856300"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8f46aae1853c0b9a5d5b2ae5b2c6547f9c45458e","target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false,"digest":{"line_hashes":["95684936663425227581478169629733210733","78271862597757234866865187883678106689","86553225653796865187660634682691417360","83045942880306541814562217583650842310","115941277113593138183873853884904520287","179216725968750459647782714189745461208"],"threshold":0.9},"id":"ASB-A-478861451-8b1f36d2"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8f46aae1853c0b9a5d5b2ae5b2c6547f9c45458e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478861451.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1049e39a373ba23ce55c697c8403f1978d5c0a4d","target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["95684936663425227581478169629733210733","78271862597757234866865187883678106689","86553225653796865187660634682691417360","83045942880306541814562217583650842310","115941277113593138183873853884904520287","179216725968750459647782714189745461208"]},"id":"ASB-A-478861451-884a2726","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1049e39a373ba23ce55c697c8403f1978d5c0a4d","target":{"function":"deliverResult","file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false,"digest":{"length":587,"function_hash":"42545786270948247939115694997330856300"},"id":"ASB-A-478861451-ace5bdae","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1049e39a373ba23ce55c697c8403f1978d5c0a4d"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478861451.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"length":587,"function_hash":"42545786270948247939115694997330856300"},"id":"ASB-A-478861451-01a5f230","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f06be8d7718d583029b5c8ff0e21a1ac94f8eb00","target":{"function":"deliverResult","file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false},{"id":"ASB-A-478861451-891819bd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f06be8d7718d583029b5c8ff0e21a1ac94f8eb00","target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"},"deprecated":false,"digest":{"line_hashes":["95684936663425227581478169629733210733","78271862597757234866865187883678106689","86553225653796865187660634682691417360","83045942880306541814562217583650842310","115941277113593138183873853884904520287","179216725968750459647782714189745461208"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f06be8d7718d583029b5c8ff0e21a1ac94f8eb00"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-478861451.json"}}],"schema_version":"1.9.2"}