{"id":"ASB-A-491253353","details":"In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-491253353","CVE-2026-28603"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["254135208065114074428372951261690934042","228182769056667432092538698315744223959","264706955376400474874447664348359889659","318696653688491585257393060833995396627"]},"id":"ASB-A-491253353-a07f3d53","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e2db447a6a08163c8140e56e1e604576d4fd5c5c","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e2db447a6a08163c8140e56e1e604576d4fd5c5c","target":{"function":"assertSafeToStartCustomActivity","file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"length":581,"function_hash":"81445960912966084671613664373860353340"},"id":"ASB-A-491253353-e3c37b25"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/e2db447a6a08163c8140e56e1e604576d4fd5c5c"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/bf5e5cf1ff46bba76526fcad7e0a0af91adac560"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/bf5e5cf1ff46bba76526fcad7e0a0af91adac560","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"},"deprecated":false,"digest":{"function_hash":"81445960912966084671613664373860353340","length":581},"id":"ASB-A-491253353-093e06ef","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["254135208065114074428372951261690934042","228182769056667432092538698315744223959","264706955376400474874447664348359889659","318696653688491585257393060833995396627"],"threshold":0.9},"id":"ASB-A-491253353-4ecf1a8f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/bf5e5cf1ff46bba76526fcad7e0a0af91adac560","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":581,"function_hash":"81445960912966084671613664373860353340"},"id":"ASB-A-491253353-68051518","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/0a9b0b20f33499eae37981a68d527c848254245b","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/0a9b0b20f33499eae37981a68d527c848254245b","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["254135208065114074428372951261690934042","228182769056667432092538698315744223959","264706955376400474874447664348359889659","318696653688491585257393060833995396627"]},"id":"ASB-A-491253353-d5574be3"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/0a9b0b20f33499eae37981a68d527c848254245b"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"line_hashes":["254135208065114074428372951261690934042","228182769056667432092538698315744223959","264706955376400474874447664348359889659","318696653688491585257393060833995396627"],"threshold":0.9},"id":"ASB-A-491253353-1b4e3953","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52acda89357f0596f203be1334bf90024b0ed490"},{"deprecated":false,"digest":{"function_hash":"81445960912966084671613664373860353340","length":581},"id":"ASB-A-491253353-d5b12270","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52acda89357f0596f203be1334bf90024b0ed490","target":{"function":"assertSafeToStartCustomActivity","file":"src/com/android/settings/users/AppRestrictionsFragment.java"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/52acda89357f0596f203be1334bf90024b0ed490"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/df6c1b2471a9d23d3890a711625cf135c7c46257","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"},"deprecated":false,"digest":{"function_hash":"81445960912966084671613664373860353340","length":581},"id":"ASB-A-491253353-64877f4b","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["254135208065114074428372951261690934042","228182769056667432092538698315744223959","264706955376400474874447664348359889659","318696653688491585257393060833995396627"],"threshold":0.9},"id":"ASB-A-491253353-ad700201","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/df6c1b2471a9d23d3890a711625cf135c7c46257","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/df6c1b2471a9d23d3890a711625cf135c7c46257"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-491253353-1e022709","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/63dbf22bdba0e8d3e1671c1413462a1abd649056","target":{"function":"assertSafeToStartCustomActivity","file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"length":581,"function_hash":"81445960912966084671613664373860353340"}},{"deprecated":false,"digest":{"line_hashes":["254135208065114074428372951261690934042","228182769056667432092538698315744223959","264706955376400474874447664348359889659","318696653688491585257393060833995396627"],"threshold":0.9},"id":"ASB-A-491253353-56e0749c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/63dbf22bdba0e8d3e1671c1413462a1abd649056","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/63dbf22bdba0e8d3e1671c1413462a1abd649056"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491253353.json"}}],"schema_version":"1.9.0"}