{"id":"ASB-A-484148949","details":"In setupLayout of PickActivity.java, there is a possible bypass of the \"Install unknown apps\" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-484148949","CVE-2026-28636"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/32d6a7338dc3f655832c2832dc93d2cc66a2021e"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["103502400345607294393142118702258590127","264578776238228467373563782560745062698","38333945831087452299655159235332406990","125995445259084665981549517189839964459"]},"id":"ASB-A-484148949-519c4105","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/32d6a7338dc3f655832c2832dc93d2cc66a2021e","target":{"file":"src/com/android/documentsui/picker/PickActivity.java"}},{"target":{"file":"src/com/android/documentsui/picker/PickActivity.java","function":"setupLayout"},"deprecated":false,"digest":{"function_hash":"156743767400915202046690974386472525007","length":1678},"id":"ASB-A-484148949-b9003726","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/32d6a7338dc3f655832c2832dc93d2cc66a2021e"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-484148949.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["103502400345607294393142118702258590127","264578776238228467373563782560745062698","38333945831087452299655159235332406990","111416144613965476055017657672312028260"],"threshold":0.9},"id":"ASB-A-484148949-9cef64bf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/550b1a413361b58511a92c0e4a451c5efd0945f1","target":{"file":"src/com/android/documentsui/picker/PickActivity.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/550b1a413361b58511a92c0e4a451c5efd0945f1","target":{"function":"setupLayout","file":"src/com/android/documentsui/picker/PickActivity.java"},"deprecated":false,"digest":{"length":1240,"function_hash":"210208562606341878581047640278892643461"},"id":"ASB-A-484148949-bb1baa77"}],"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/550b1a413361b58511a92c0e4a451c5efd0945f1"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-484148949.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/8eebea12db1815135398dfcc4c0276966c2790f9","target":{"file":"src/com/android/documentsui/picker/PickActivity.java","function":"setupLayout"},"deprecated":false,"digest":{"length":1460,"function_hash":"120162466560451992709576043753057550201"},"id":"ASB-A-484148949-36b499ce","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/8eebea12db1815135398dfcc4c0276966c2790f9","target":{"file":"src/com/android/documentsui/picker/PickActivity.java"},"deprecated":false,"digest":{"line_hashes":["103502400345607294393142118702258590127","264578776238228467373563782560745062698","38333945831087452299655159235332406990","111416144613965476055017657672312028260"],"threshold":0.9},"id":"ASB-A-484148949-9f4b7c3d"}],"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/8eebea12db1815135398dfcc4c0276966c2790f9"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-484148949.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/c2f4dc99c7c705c971a5630ff1627554bbf2876b","target":{"function":"setupLayout","file":"src/com/android/documentsui/picker/PickActivity.java"},"deprecated":false,"digest":{"function_hash":"156743767400915202046690974386472525007","length":1678},"id":"ASB-A-484148949-44db94f0"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/c2f4dc99c7c705c971a5630ff1627554bbf2876b","target":{"file":"src/com/android/documentsui/picker/PickActivity.java"},"deprecated":false,"digest":{"line_hashes":["103502400345607294393142118702258590127","264578776238228467373563782560745062698","38333945831087452299655159235332406990","125995445259084665981549517189839964459"],"threshold":0.9},"id":"ASB-A-484148949-54aa3cbc"}],"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/c2f4dc99c7c705c971a5630ff1627554bbf2876b"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-484148949.json"}},{"package":{"name":"platform/packages/apps/DocumentsUI","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/631cfe0fc0bddaea1ff7dade5f9c1ac46100d91b","target":{"file":"src/com/android/documentsui/picker/PickActivity.java","function":"setupLayout"},"deprecated":false,"digest":{"function_hash":"62780047556389138076162461782259110862","length":1009},"id":"ASB-A-484148949-cb97d3d5","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/631cfe0fc0bddaea1ff7dade5f9c1ac46100d91b","target":{"file":"src/com/android/documentsui/picker/PickActivity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["103502400345607294393142118702258590127","321784852465166673021149462032257623205","273463559620289439968745718978014284962","231780973864924926929498320679730924075"]},"id":"ASB-A-484148949-ded5e133","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/631cfe0fc0bddaea1ff7dade5f9c1ac46100d91b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-484148949.json"}}],"schema_version":"1.9.0"}