{"id":"ASB-A-487147249","details":"In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-487147249","CVE-2026-28599"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["154216155528703273005092877639218488988","324993677115389383557290111810716566376","161951373412032675668896320430866425004","84815149263490886434480395678664458264"]},"id":"ASB-A-487147249-1f4584e5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dc03f183688231c065ac0e13ef10a00732ba7199","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"addCreatorToken"},"deprecated":false,"digest":{"length":1309,"function_hash":"321204840111195526629169247703648001245"},"id":"ASB-A-487147249-9293603f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dc03f183688231c065ac0e13ef10a00732ba7199"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dc03f183688231c065ac0e13ef10a00732ba7199"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487147249.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["154216155528703273005092877639218488988","324993677115389383557290111810716566376","161951373412032675668896320430866425004","84815149263490886434480395678664458264"],"threshold":0.9},"id":"ASB-A-487147249-3220adba","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7c714bd3b2222d8d7331d609f08be65b9d67dbea","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"}},{"id":"ASB-A-487147249-980506c3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7c714bd3b2222d8d7331d609f08be65b9d67dbea","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"addCreatorToken"},"deprecated":false,"digest":{"length":1768,"function_hash":"34177301796551893962902788463562082780"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7c714bd3b2222d8d7331d609f08be65b9d67dbea"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487147249.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8aa520888483a29cedb09023b88f5e29dee966fb"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/8aa520888483a29cedb09023b88f5e29dee966fb","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["154216155528703273005092877639218488988","324993677115389383557290111810716566376","161951373412032675668896320430866425004","84815149263490886434480395678664458264"],"threshold":0.9},"id":"ASB-A-487147249-81c7299e","signature_type":"Line","signature_version":"v1"},{"target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"addCreatorToken"},"deprecated":false,"digest":{"function_hash":"34177301796551893962902788463562082780","length":1768},"id":"ASB-A-487147249-bfd5acfe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8aa520888483a29cedb09023b88f5e29dee966fb"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487147249.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/acbde95f3eec1695d5bf4fa52e4153ef1d1a708a"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/acbde95f3eec1695d5bf4fa52e4153ef1d1a708a","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java"},"deprecated":false,"digest":{"line_hashes":["154216155528703273005092877639218488988","324993677115389383557290111810716566376","161951373412032675668896320430866425004","84815149263490886434480395678664458264"],"threshold":0.9},"id":"ASB-A-487147249-e8caecbd","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/acbde95f3eec1695d5bf4fa52e4153ef1d1a708a","target":{"file":"services/core/java/com/android/server/am/ActivityManagerService.java","function":"addCreatorToken"},"deprecated":false,"digest":{"length":1309,"function_hash":"321204840111195526629169247703648001245"},"id":"ASB-A-487147249-f35584d2","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487147249.json"}}],"schema_version":"1.9.0"}