{"id":"ASB-A-490916793","details":"In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-490916793","CVE-2026-49931"],"modified":"2026-11-02T17:11:16.381614259Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/c640414ba5ec8279ec48ae1093baa3be5878d6bc"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"digest":{"length":1276,"function_hash":"103968484199198446824883636299324756751"},"id":"ASB-A-490916793-2db7447b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/c640414ba5ec8279ec48ae1093baa3be5878d6bc","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java","function":"onActivityResult"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/c640414ba5ec8279ec48ae1093baa3be5878d6bc","target":{"function":"onActivityResult","file":"src/com/android/phone/CdmaCallForwardOptions.java"},"deprecated":false,"digest":{"function_hash":"103968484199198446824883636299324756751","length":1276},"id":"ASB-A-490916793-31f258e7"},{"deprecated":false,"digest":{"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"],"threshold":0.9},"id":"ASB-A-490916793-6ccd23e7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/c640414ba5ec8279ec48ae1093baa3be5878d6bc","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java"}},{"source":"https://android.googlesource.com/platform/packages/services/Telephony/+/c640414ba5ec8279ec48ae1093baa3be5878d6bc","target":{"file":"src/com/android/phone/CdmaCallForwardOptions.java"},"deprecated":false,"digest":{"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"],"threshold":0.9},"id":"ASB-A-490916793-f3cd1dda","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490916793.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"103968484199198446824883636299324756751","length":1276},"id":"ASB-A-490916793-116fa6ca","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/0d200e6873897ebd83917edb4f289889f7e803c1","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java","function":"onActivityResult"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/0d200e6873897ebd83917edb4f289889f7e803c1","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"]},"id":"ASB-A-490916793-1270e488","signature_type":"Line"},{"target":{"file":"src/com/android/phone/CdmaCallForwardOptions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"]},"id":"ASB-A-490916793-9c33fa49","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/0d200e6873897ebd83917edb4f289889f7e803c1"},{"id":"ASB-A-490916793-d8d3ebd2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/0d200e6873897ebd83917edb4f289889f7e803c1","target":{"function":"onActivityResult","file":"src/com/android/phone/CdmaCallForwardOptions.java"},"deprecated":false,"digest":{"function_hash":"103968484199198446824883636299324756751","length":1276}}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/0d200e6873897ebd83917edb4f289889f7e803c1"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490916793.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"103968484199198446824883636299324756751","length":1276},"id":"ASB-A-490916793-23c5bb17","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/d617606a49b1a457b31e195b3b652ae21115ced7","target":{"file":"src/com/android/phone/CdmaCallForwardOptions.java","function":"onActivityResult"}},{"id":"ASB-A-490916793-5fd07e9c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/d617606a49b1a457b31e195b3b652ae21115ced7","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java"},"deprecated":false,"digest":{"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"],"threshold":0.9}},{"id":"ASB-A-490916793-edcaeeda","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/d617606a49b1a457b31e195b3b652ae21115ced7","target":{"file":"src/com/android/phone/CdmaCallForwardOptions.java"},"deprecated":false,"digest":{"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"103968484199198446824883636299324756751","length":1276},"id":"ASB-A-490916793-fbbae1af","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/d617606a49b1a457b31e195b3b652ae21115ced7","target":{"function":"onActivityResult","file":"src/com/android/phone/GsmUmtsCallForwardOptions.java"}}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/d617606a49b1a457b31e195b3b652ae21115ced7"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490916793.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/services/Telephony/+/54edaa1592d7d329710dbf8fec0551a19a7895fb","target":{"function":"onActivityResult","file":"src/com/android/phone/CdmaCallForwardOptions.java"},"deprecated":false,"digest":{"function_hash":"103968484199198446824883636299324756751","length":1276},"id":"ASB-A-490916793-1aadf498","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"],"threshold":0.9},"id":"ASB-A-490916793-2990f708","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/54edaa1592d7d329710dbf8fec0551a19a7895fb","target":{"file":"src/com/android/phone/CdmaCallForwardOptions.java"}},{"deprecated":false,"digest":{"length":1276,"function_hash":"103968484199198446824883636299324756751"},"id":"ASB-A-490916793-ee9071e4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/54edaa1592d7d329710dbf8fec0551a19a7895fb","target":{"function":"onActivityResult","file":"src/com/android/phone/GsmUmtsCallForwardOptions.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/54edaa1592d7d329710dbf8fec0551a19a7895fb","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java"},"deprecated":false,"digest":{"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"],"threshold":0.9},"id":"ASB-A-490916793-f6cb0f27"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/54edaa1592d7d329710dbf8fec0551a19a7895fb"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490916793.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/ab08c74efefb3aabfc7d799f323b42b5ba94e048","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java"},"deprecated":false,"digest":{"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"],"threshold":0.9},"id":"ASB-A-490916793-4900e167","signature_type":"Line"},{"id":"ASB-A-490916793-62c32c8c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/ab08c74efefb3aabfc7d799f323b42b5ba94e048","target":{"function":"onActivityResult","file":"src/com/android/phone/CdmaCallForwardOptions.java"},"deprecated":false,"digest":{"function_hash":"103968484199198446824883636299324756751","length":1276}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/ab08c74efefb3aabfc7d799f323b42b5ba94e048","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java","function":"onActivityResult"},"deprecated":false,"digest":{"length":1276,"function_hash":"103968484199198446824883636299324756751"},"id":"ASB-A-490916793-783caef7"},{"target":{"file":"src/com/android/phone/CdmaCallForwardOptions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"]},"id":"ASB-A-490916793-d2c4aa0e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/ab08c74efefb3aabfc7d799f323b42b5ba94e048"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/ab08c74efefb3aabfc7d799f323b42b5ba94e048"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490916793.json"}},{"package":{"name":"platform/packages/services/Telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/services/Telephony/+/794a93e4d35ccbbefcec53d2c4cd27e31c0e8f82","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java","function":"onActivityResult"},"deprecated":false,"digest":{"function_hash":"200947186183704391661863674646234951375","length":374},"id":"ASB-A-490916793-13bd64c4","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/794a93e4d35ccbbefcec53d2c4cd27e31c0e8f82","target":{"file":"src/com/android/phone/CdmaCallForwardOptions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","114323385759680923113318675639132774737","190840248804210687427189770524413441539","16509948692697771112421212207241914987"]},"id":"ASB-A-490916793-93393993"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["287787768402327033209875062817319602379","211968006879700468532166219264504832782","267200528065576025160866720204855513011","222446364389224055696768830594255630233","161256326281681462541982760580747867356","175809345683373156427955168863815674691","292873032105161123997174662194530398747","266413371023429680860609210177785097760"]},"id":"ASB-A-490916793-9c19061f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/794a93e4d35ccbbefcec53d2c4cd27e31c0e8f82","target":{"file":"src/com/android/phone/GsmUmtsCallForwardOptions.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telephony/+/794a93e4d35ccbbefcec53d2c4cd27e31c0e8f82","target":{"file":"src/com/android/phone/CdmaCallForwardOptions.java","function":"onActivityResult"},"deprecated":false,"digest":{"function_hash":"103968484199198446824883636299324756751","length":1276},"id":"ASB-A-490916793-b9700d5e","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/794a93e4d35ccbbefcec53d2c4cd27e31c0e8f82"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-490916793.json"}}],"schema_version":"1.9.2"}