{"id":"ASB-A-487522353","details":"In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-487522353","CVE-2026-28582"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead","target":{"function":"onCreate","file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"},"deprecated":false,"digest":{"length":5863,"function_hash":"225355106264462343682862456478620329099"},"id":"ASB-A-487522353-0c9800eb"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead","target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"},"deprecated":false,"digest":{"line_hashes":["9652668052313215211809457435577099329","42302541755554764317914228322417196827","182510943443562764666308444493969446172","268510628125414722993030442318504867595","102830875642936636489652925739976357282","122815770119339302529597811558588685136","231546043599135225282422895037581395220"],"threshold":0.9},"id":"ASB-A-487522353-6d97024b","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead","target":{"file":"tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"},"deprecated":false,"digest":{"line_hashes":["50448111178302970871280963852843707910","73631506534017129656694136800952130062","272470036045758090437155815418827724949","159824744492675985466948094975854045731"],"threshold":0.9},"id":"ASB-A-487522353-b1b85ee4","match_only_versions":["17-next"],"signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3","target":{"file":"tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"},"deprecated":false,"digest":{"line_hashes":["50448111178302970871280963852843707910","73631506534017129656694136800952130062","272470036045758090437155815418827724949","159824744492675985466948094975854045731"],"threshold":0.9},"id":"ASB-A-487522353-8bd60f9d","match_only_versions":["15"],"signature_type":"Line"},{"id":"ASB-A-487522353-de1e6631","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3","target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"},"deprecated":false,"digest":{"line_hashes":["9652668052313215211809457435577099329","42302541755554764317914228322417196827","182510943443562764666308444493969446172","268510628125414722993030442318504867595","102830875642936636489652925739976357282","122815770119339302529597811558588685136","231546043599135225282422895037581395220"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"320482628526730975322324512763471195204","length":5039},"id":"ASB-A-487522353-eb31bad5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3","target":{"function":"onCreate","file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3"],"severity":"High","spl":"2026-09-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["50448111178302970871280963852843707910","73631506534017129656694136800952130062","272470036045758090437155815418827724949","159824744492675985466948094975854045731"],"threshold":0.9},"id":"ASB-A-487522353-218e8dc4","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737","target":{"file":"tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"}},{"digest":{"function_hash":"257570518455334185191298288611603367511","length":6086},"id":"ASB-A-487522353-e39e82fa","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737","target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java","function":"onCreate"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737","target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["9652668052313215211809457435577099329","42302541755554764317914228322417196827","182510943443562764666308444493969446172","268510628125414722993030442318504867595","102830875642936636489652925739976357282","122815770119339302529597811558588685136","231546043599135225282422895037581395220"]},"id":"ASB-A-487522353-e61efb9b","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["9652668052313215211809457435577099329","42302541755554764317914228322417196827","182510943443562764666308444493969446172","268510628125414722993030442318504867595","102830875642936636489652925739976357282","122815770119339302529597811558588685136","231546043599135225282422895037581395220"]},"id":"ASB-A-487522353-480c53cf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/83dbc69ae56bdd5dfdb562f44a86f488378e40fe","target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"}},{"id":"ASB-A-487522353-c8c65ff9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/83dbc69ae56bdd5dfdb562f44a86f488378e40fe","target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java","function":"onCreate"},"deprecated":false,"digest":{"length":5955,"function_hash":"270794111176202381152047372900889284977"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/83dbc69ae56bdd5dfdb562f44a86f488378e40fe"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-487522353-c48c9431","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205","target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"},"deprecated":false,"digest":{"line_hashes":["9652668052313215211809457435577099329","42302541755554764317914228322417196827","182510943443562764666308444493969446172","268510628125414722993030442318504867595","102830875642936636489652925739976357282","122815770119339302529597811558588685136","231546043599135225282422895037581395220"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"225355106264462343682862456478620329099","length":5863},"id":"ASB-A-487522353-d429800a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205","target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java","function":"onCreate"}},{"match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205","target":{"file":"tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"},"deprecated":false,"digest":{"line_hashes":["50448111178302970871280963852843707910","73631506534017129656694136800952130062","272470036045758090437155815418827724949","159824744492675985466948094975854045731"],"threshold":0.9},"id":"ASB-A-487522353-f97d7f66"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/319bd99e56dbc79207713063fe8a19bbe9f71f72"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/319bd99e56dbc79207713063fe8a19bbe9f71f72","target":{"function":"onCreate","file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"},"deprecated":false,"digest":{"function_hash":"36075075032965457562063846557597081223","length":3198},"id":"ASB-A-487522353-23b50908"},{"digest":{"threshold":0.9,"line_hashes":["287616441439893114008460994366789998014","294793562361303601986062338465746709359","147597210763174070709041303428320196360","130210970787776341656751929764056254081","79856535076905567870523655038863588052","334101330933833103231535792610573397536","263087673580089959162153258465159764742"]},"id":"ASB-A-487522353-67892b56","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/319bd99e56dbc79207713063fe8a19bbe9f71f72","target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-487522353.json"}}],"schema_version":"1.9.0"}