{"id":"ASB-A-491748298","details":"In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-491748298","CVE-2026-45521"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68045358585044474446901610051439424734","250326445565784778221853878595895170606","178991010253533399621632707677886416764","277651685365647603381083296012695307991","33910646580015812090253805627061887362","189441484385343235705717260470742951750","118487118811602319524549213924714398637","113403240795576765742663726004218098615"]},"id":"ASB-A-491748298-1d26dc8f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8"},{"deprecated":false,"digest":{"function_hash":"14896423120790572720039217425494905313","length":504},"id":"ASB-A-491748298-2027f7b1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8","target":{"function":"openFile","file":"services/core/java/com/android/server/storage/AppFuseBridge.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8","target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"openProxyFileDescriptor"},"deprecated":false,"digest":{"length":523,"function_hash":"298992070416577973243581378451983588942"},"id":"ASB-A-491748298-32356aa8"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8","target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"},"deprecated":false,"digest":{"line_hashes":["141719123259839516007060757372302818956","73261760971868016508560516057191027614","168944687444037655817931836439574434632","241740515989576591599297069621103948289","76268198549368217911361443251866758233","236396324232536418671494321407880789372","238567063692417096492463078415612943735","13447263821089926019812060962662837557","82213311895402701621995098103434020533"],"threshold":0.9},"id":"ASB-A-491748298-8065b718","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491748298.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["141719123259839516007060757372302818956","73261760971868016508560516057191027614","168944687444037655817931836439574434632","241740515989576591599297069621103948289","76268198549368217911361443251866758233","236396324232536418671494321407880789372","238567063692417096492463078415612943735","13447263821089926019812060962662837557","82213311895402701621995098103434020533"],"threshold":0.9},"id":"ASB-A-491748298-7bde1ab3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964","target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"}},{"id":"ASB-A-491748298-8a4c9fa1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964","target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"openProxyFileDescriptor"},"deprecated":false,"digest":{"function_hash":"298992070416577973243581378451983588942","length":523}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68045358585044474446901610051439424734","250326445565784778221853878595895170606","178991010253533399621632707677886416764","277651685365647603381083296012695307991","33910646580015812090253805627061887362","189441484385343235705717260470742951750","118487118811602319524549213924714398637","113403240795576765742663726004218098615"]},"id":"ASB-A-491748298-e541d4fc","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964","target":{"function":"openFile","file":"services/core/java/com/android/server/storage/AppFuseBridge.java"},"deprecated":false,"digest":{"function_hash":"14896423120790572720039217425494905313","length":504},"id":"ASB-A-491748298-edeac4ed"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491748298.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-491748298-68d6b782","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false,"digest":{"line_hashes":["68045358585044474446901610051439424734","250326445565784778221853878595895170606","178991010253533399621632707677886416764","277651685365647603381083296012695307991","33910646580015812090253805627061887362","189441484385343235705717260470742951750","118487118811602319524549213924714398637","113403240795576765742663726004218098615"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9","target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["141719123259839516007060757372302818956","73261760971868016508560516057191027614","168944687444037655817931836439574434632","241740515989576591599297069621103948289","76268198549368217911361443251866758233","236396324232536418671494321407880789372","238567063692417096492463078415612943735","13447263821089926019812060962662837557","82213311895402701621995098103434020533"]},"id":"ASB-A-491748298-913eda85"},{"digest":{"function_hash":"298992070416577973243581378451983588942","length":523},"id":"ASB-A-491748298-d9d60c06","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9","target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"openProxyFileDescriptor"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9","target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java","function":"openFile"},"deprecated":false,"digest":{"function_hash":"14896423120790572720039217425494905313","length":504},"id":"ASB-A-491748298-f9b9caca"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491748298.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb","target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"},"deprecated":false,"digest":{"line_hashes":["141719123259839516007060757372302818956","73261760971868016508560516057191027614","168944687444037655817931836439574434632","241740515989576591599297069621103948289","76268198549368217911361443251866758233","236396324232536418671494321407880789372","238567063692417096492463078415612943735","13447263821089926019812060962662837557","82213311895402701621995098103434020533"],"threshold":0.9},"id":"ASB-A-491748298-60caabba"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb","target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"openProxyFileDescriptor"},"deprecated":false,"digest":{"length":523,"function_hash":"298992070416577973243581378451983588942"},"id":"ASB-A-491748298-808ee7c7","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68045358585044474446901610051439424734","250326445565784778221853878595895170606","178991010253533399621632707677886416764","277651685365647603381083296012695307991","33910646580015812090253805627061887362","189441484385343235705717260470742951750","118487118811602319524549213924714398637","113403240795576765742663726004218098615"]},"id":"ASB-A-491748298-b203450c","signature_type":"Line"},{"digest":{"length":504,"function_hash":"14896423120790572720039217425494905313"},"id":"ASB-A-491748298-bff8d0cf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb","target":{"function":"openFile","file":"services/core/java/com/android/server/storage/AppFuseBridge.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491748298.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68045358585044474446901610051439424734","250326445565784778221853878595895170606","178991010253533399621632707677886416764","277651685365647603381083296012695307991","33910646580015812090253805627061887362","189441484385343235705717260470742951750","118487118811602319524549213924714398637","113403240795576765742663726004218098615"]},"id":"ASB-A-491748298-9537655b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}},{"target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"openProxyFileDescriptor"},"deprecated":false,"digest":{"function_hash":"298992070416577973243581378451983588942","length":523},"id":"ASB-A-491748298-bffb24ca","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501"},{"deprecated":false,"digest":{"function_hash":"14896423120790572720039217425494905313","length":504},"id":"ASB-A-491748298-c5ff2b40","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501","target":{"function":"openFile","file":"services/core/java/com/android/server/storage/AppFuseBridge.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501","target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"},"deprecated":false,"digest":{"line_hashes":["141719123259839516007060757372302818956","73261760971868016508560516057191027614","168944687444037655817931836439574434632","241740515989576591599297069621103948289","76268198549368217911361443251866758233","236396324232536418671494321407880789372","238567063692417096492463078415612943735","13447263821089926019812060962662837557","82213311895402701621995098103434020533"],"threshold":0.9},"id":"ASB-A-491748298-ce11a253","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501"],"severity":"High","spl":"2026-09-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491748298.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["68045358585044474446901610051439424734","250326445565784778221853878595895170606","178991010253533399621632707677886416764","277651685365647603381083296012695307991","33910646580015812090253805627061887362","189441484385343235705717260470742951750","118487118811602319524549213924714398637","113403240795576765742663726004218098615"]},"id":"ASB-A-491748298-1a750c28","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15","target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"},"deprecated":false,"digest":{"line_hashes":["141719123259839516007060757372302818956","73261760971868016508560516057191027614","168944687444037655817931836439574434632","241740515989576591599297069621103948289","76268198549368217911361443251866758233","236396324232536418671494321407880789372","238567063692417096492463078415612943735","13447263821089926019812060962662837557","82213311895402701621995098103434020533"],"threshold":0.9},"id":"ASB-A-491748298-4cb5360f","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-491748298-621423d1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15","target":{"function":"openFile","file":"services/core/java/com/android/server/storage/AppFuseBridge.java"},"deprecated":false,"digest":{"length":504,"function_hash":"14896423120790572720039217425494905313"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15","target":{"function":"openProxyFileDescriptor","file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false,"digest":{"function_hash":"298992070416577973243581378451983588942","length":523},"id":"ASB-A-491748298-d90d7d0e"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-491748298.json"}}],"schema_version":"1.9.0"}