{"id":"ASB-A-488559440","details":"In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-488559440","CVE-2026-28665"],"modified":"2026-11-02T17:11:17.481363414Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["246169816405647692499524239342190472311","105470993024769954317360891690608473714","128308239018263253172227981530277964292","328505252957141748629558253793002781018","188589374481843725415890599871493896358","126895137050304787978971260611472417111"],"threshold":0.9},"id":"ASB-A-488559440-9a1a0094","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8510db1f2aa478417779b692f520f8e99d4e5613","target":{"file":"src/com/android/settings/SettingsApplication.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8510db1f2aa478417779b692f520f8e99d4e5613","target":{"function":"onCreate","file":"src/com/android/settings/SettingsApplication.java"},"deprecated":false,"digest":{"length":1139,"function_hash":"231336808095079745265023427542753316092"},"id":"ASB-A-488559440-e3c3c287","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/8510db1f2aa478417779b692f520f8e99d4e5613"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-488559440.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["2437666800125410032044493672321646524","197698306975288387841995760526849344792","218493847148273954671752156808368553221","261280674102495525403044823363170959863","213167992376426858168603531358403700999","153858358969780592026132233684551846497"],"threshold":0.9},"id":"ASB-A-488559440-07e9ce9e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/b3f1b5eee50441d14466f493af93693ffd3e1176","target":{"file":"src/com/android/settings/SettingsApplication.java"}},{"digest":{"function_hash":"16635445329389267093334936794775074366","length":637},"id":"ASB-A-488559440-1c0d07af","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/b3f1b5eee50441d14466f493af93693ffd3e1176","target":{"function":"onCreate","file":"src/com/android/settings/SettingsApplication.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/b3f1b5eee50441d14466f493af93693ffd3e1176"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-488559440.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a92b25a61b0a518f50f26815ae32bc6a2b1ccbbb","target":{"file":"src/com/android/settings/SettingsApplication.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"109402099061448261267809259229866041099","length":820},"id":"ASB-A-488559440-3c8a11a5"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a92b25a61b0a518f50f26815ae32bc6a2b1ccbbb","target":{"file":"src/com/android/settings/SettingsApplication.java"},"deprecated":false,"digest":{"line_hashes":["246169816405647692499524239342190472311","105470993024769954317360891690608473714","128308239018263253172227981530277964292","328505252957141748629558253793002781018","87562221415134385637475834889779275455","231998890685561808016198277234674382412"],"threshold":0.9},"id":"ASB-A-488559440-bd7985d5"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/a92b25a61b0a518f50f26815ae32bc6a2b1ccbbb"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-488559440.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/455424510584130ce1ca7be36b5ed25cca347551","target":{"file":"src/com/android/settings/SettingsApplication.java"},"deprecated":false,"digest":{"line_hashes":["246169816405647692499524239342190472311","105470993024769954317360891690608473714","128308239018263253172227981530277964292","328505252957141748629558253793002781018","87562221415134385637475834889779275455","231998890685561808016198277234674382412"],"threshold":0.9},"id":"ASB-A-488559440-4344fb20","signature_type":"Line"},{"target":{"file":"src/com/android/settings/SettingsApplication.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"230265717417269882024556575627483007564","length":903},"id":"ASB-A-488559440-9441f7c8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/455424510584130ce1ca7be36b5ed25cca347551"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/455424510584130ce1ca7be36b5ed25cca347551"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-488559440.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/50d61685ab9b6e03996f6b93cc8b0fc337e8410c","target":{"file":"src/com/android/settings/SettingsApplication.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"231336808095079745265023427542753316092","length":1139},"id":"ASB-A-488559440-468817c2"},{"deprecated":false,"digest":{"line_hashes":["246169816405647692499524239342190472311","105470993024769954317360891690608473714","128308239018263253172227981530277964292","328505252957141748629558253793002781018","188589374481843725415890599871493896358","126895137050304787978971260611472417111"],"threshold":0.9},"id":"ASB-A-488559440-d9919b22","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/50d61685ab9b6e03996f6b93cc8b0fc337e8410c","target":{"file":"src/com/android/settings/SettingsApplication.java"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/50d61685ab9b6e03996f6b93cc8b0fc337e8410c"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-488559440.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/5a55a5ef9eee97c26116d2a406c39f268832d9b3"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":417,"function_hash":"310456319177128819897285623272536075005"},"id":"ASB-A-488559440-269f602a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5a55a5ef9eee97c26116d2a406c39f268832d9b3","target":{"file":"src/com/android/settings/SettingsApplication.java","function":"onCreate"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5a55a5ef9eee97c26116d2a406c39f268832d9b3","target":{"file":"src/com/android/settings/SettingsApplication.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["296778435192530024690667490134796248425","227931181050659837864617912757081703736","23676601859244052999184490921588612382","233544609875124650973294094270689968052","326521825660509040259628699238423839787"]},"id":"ASB-A-488559440-905f3c01"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-488559440.json"}}],"schema_version":"1.9.2"}