{"id":"ASB-A-490605007","details":"In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-490605007","CVE-2026-28600"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c2f680bf6093ab63403d681d9d283e09797d6bfe","target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"},"deprecated":false,"digest":{"line_hashes":["269643275258832763219810201022128309285","143977629545445981829839722069500161958","15434907803721309085010133421235260763","26887444956522917119607886322404052261","253128488464435898958424214939137236666","266290051878553554220135927594165153896","149356766050854835069309200948252449869","223782692571102201550214551239572834815","50136628364341449192579111435556949942","244956004506230625950625067013422618896"],"threshold":0.9},"id":"ASB-A-490605007-c3fa5f8a","match_only_versions":["17-next"],"signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c2f680bf6093ab63403d681d9d283e09797d6bfe","target":{"function":"onCreate","file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"},"deprecated":false,"digest":{"length":636,"function_hash":"14111201312336166118256428086376610140"},"id":"ASB-A-490605007-f13d00c1","match_only_versions":["17-next"]}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/c2f680bf6093ab63403d681d9d283e09797d6bfe"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490605007.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["269643275258832763219810201022128309285","143977629545445981829839722069500161958","15434907803721309085010133421235260763","26887444956522917119607886322404052261","253128488464435898958424214939137236666","266290051878553554220135927594165153896","149356766050854835069309200948252449869","223782692571102201550214551239572834815","50136628364341449192579111435556949942","244956004506230625950625067013422618896"],"threshold":0.9},"id":"ASB-A-490605007-05fafa33","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6d2904fff3751a7119c938084de6445cdf1b3281","target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"}},{"deprecated":false,"digest":{"length":636,"function_hash":"14111201312336166118256428086376610140"},"id":"ASB-A-490605007-6581ba87","match_only_versions":["15"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6d2904fff3751a7119c938084de6445cdf1b3281","target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java","function":"onCreate"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/6d2904fff3751a7119c938084de6445cdf1b3281"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490605007.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-490605007-0754853b","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/26f09518a088de8bfe384d98900d5125ba76db9b","target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"14111201312336166118256428086376610140","length":636}},{"id":"ASB-A-490605007-82c2a80d","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/26f09518a088de8bfe384d98900d5125ba76db9b","target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"},"deprecated":false,"digest":{"line_hashes":["269643275258832763219810201022128309285","143977629545445981829839722069500161958","15434907803721309085010133421235260763","26887444956522917119607886322404052261","253128488464435898958424214939137236666","266290051878553554220135927594165153896","149356766050854835069309200948252449869","223782692571102201550214551239572834815","50136628364341449192579111435556949942","244956004506230625950625067013422618896"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/26f09518a088de8bfe384d98900d5125ba76db9b"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490605007.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8a83e6bd2ca5dd61697861ad9359e657b0782560","target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"},"deprecated":false,"digest":{"line_hashes":["269643275258832763219810201022128309285","143977629545445981829839722069500161958","15434907803721309085010133421235260763","26887444956522917119607886322404052261","253128488464435898958424214939137236666","266290051878553554220135927594165153896","149356766050854835069309200948252449869","223782692571102201550214551239572834815","50136628364341449192579111435556949942","244956004506230625950625067013422618896"],"threshold":0.9},"id":"ASB-A-490605007-4b59a4c7"},{"digest":{"function_hash":"14111201312336166118256428086376610140","length":636},"id":"ASB-A-490605007-4ea637e8","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8a83e6bd2ca5dd61697861ad9359e657b0782560","target":{"function":"onCreate","file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/8a83e6bd2ca5dd61697861ad9359e657b0782560"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490605007.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/fc195079aa356a8455aac1aeea9d6d5597259be5"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/fc195079aa356a8455aac1aeea9d6d5597259be5","target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java","function":"onCreate"},"deprecated":false,"digest":{"length":636,"function_hash":"14111201312336166118256428086376610140"},"id":"ASB-A-490605007-226847ac","match_only_versions":["17"]},{"digest":{"line_hashes":["269643275258832763219810201022128309285","143977629545445981829839722069500161958","15434907803721309085010133421235260763","26887444956522917119607886322404052261","253128488464435898958424214939137236666","266290051878553554220135927594165153896","149356766050854835069309200948252449869","223782692571102201550214551239572834815","50136628364341449192579111435556949942","244956004506230625950625067013422618896"],"threshold":0.9},"id":"ASB-A-490605007-3ad93c74","match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/fc195079aa356a8455aac1aeea9d6d5597259be5","target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490605007.json"}}],"schema_version":"1.9.0"}