{"id":"ASB-A-492683684","details":"In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-492683684","CVE-2026-28652"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Uwb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":89,"function_hash":"61649420881669196202136751094516715419"},"id":"ASB-A-492683684-14c4d7e9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobClosed"}},{"id":"ASB-A-492683684-19f8aa33","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobReconnected"},"deprecated":false,"digest":{"length":89,"function_hash":"61649420881669196202136751094516715419"}},{"target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["38025574417046419087244872309943817679","219383566330742942559279915631243045000","185135912870555563672284915387580312263","173433282797485490505767597539997242327","29139708090578226915345213323052656609","288042904670986705202418402737485351350","29061413810804428566142432396340218402","97560675729739473506765559568672199436","22464203180503072198750957484607585483","258615435524748204944395670449476632235","308547296153122471018986145785034232414","317284501128887424070738296498326299284","309368015486967817298265376259703181795","281855938897929212484442110318842302836","157710657525854923976036826425446734842","194186333511653472015913527297243387010","315802197048631648983702082296563952662","225917967681048038367711200929891927587","66508598726830257795702347688332316025","20245729583690913768502141576095310351"],"threshold":0.9},"id":"ASB-A-492683684-42d8b5d9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac"},{"id":"ASB-A-492683684-a5b71b44","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac","target":{"function":"oobDataReceived","file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"},"deprecated":false,"digest":{"function_hash":"91081891884775590369932405568289250434","length":111}},{"digest":{"length":89,"function_hash":"61649420881669196202136751094516715419"},"id":"ASB-A-492683684-ae7f89a1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobDisconnected"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac","target":{"function":"registerOobSendDataListener","file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"},"deprecated":false,"digest":{"length":89,"function_hash":"61649420881669196202136751094516715419"},"id":"ASB-A-492683684-c071e312","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-492683684.json"}},{"package":{"name":"platform/packages/modules/Uwb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobDisconnected"},"deprecated":false,"digest":{"length":89,"function_hash":"61649420881669196202136751094516715419"},"id":"ASB-A-492683684-05c86ffc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["38025574417046419087244872309943817679","219383566330742942559279915631243045000","185135912870555563672284915387580312263","173433282797485490505767597539997242327","29139708090578226915345213323052656609","288042904670986705202418402737485351350","29061413810804428566142432396340218402","97560675729739473506765559568672199436","22464203180503072198750957484607585483","258615435524748204944395670449476632235","308547296153122471018986145785034232414","317284501128887424070738296498326299284","309368015486967817298265376259703181795","281855938897929212484442110318842302836","157710657525854923976036826425446734842","194186333511653472015913527297243387010","315802197048631648983702082296563952662","225917967681048038367711200929891927587","66508598726830257795702347688332316025","20245729583690913768502141576095310351"],"threshold":0.9},"id":"ASB-A-492683684-3a1febc1"},{"id":"ASB-A-492683684-4778e163","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobReconnected"},"deprecated":false,"digest":{"function_hash":"61649420881669196202136751094516715419","length":89}},{"deprecated":false,"digest":{"function_hash":"91081891884775590369932405568289250434","length":111},"id":"ASB-A-492683684-9fbdc654","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068","target":{"function":"oobDataReceived","file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobClosed"},"deprecated":false,"digest":{"function_hash":"61649420881669196202136751094516715419","length":89},"id":"ASB-A-492683684-af448cc1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"registerOobSendDataListener"},"deprecated":false,"digest":{"function_hash":"61649420881669196202136751094516715419","length":89},"id":"ASB-A-492683684-ee9824b9","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-492683684.json"}},{"package":{"name":"platform/packages/modules/Uwb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"target":{"function":"deviceOobDisconnected","file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"},"deprecated":false,"digest":{"function_hash":"61649420881669196202136751094516715419","length":89},"id":"ASB-A-492683684-35a909fc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a"},{"id":"ASB-A-492683684-40de1af5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38025574417046419087244872309943817679","219383566330742942559279915631243045000","185135912870555563672284915387580312263","173433282797485490505767597539997242327","29139708090578226915345213323052656609","288042904670986705202418402737485351350","29061413810804428566142432396340218402","97560675729739473506765559568672199436","22464203180503072198750957484607585483","258615435524748204944395670449476632235","308547296153122471018986145785034232414","317284501128887424070738296498326299284","309368015486967817298265376259703181795","281855938897929212484442110318842302836","157710657525854923976036826425446734842","194186333511653472015913527297243387010","315802197048631648983702082296563952662","225917967681048038367711200929891927587","66508598726830257795702347688332316025","20245729583690913768502141576095310351"]}},{"source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobReconnected"},"deprecated":false,"digest":{"length":89,"function_hash":"61649420881669196202136751094516715419"},"id":"ASB-A-492683684-5749fae8","signature_type":"Function","signature_version":"v1"},{"target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobClosed"},"deprecated":false,"digest":{"length":89,"function_hash":"61649420881669196202136751094516715419"},"id":"ASB-A-492683684-68038073","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a","target":{"function":"registerOobSendDataListener","file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"},"deprecated":false,"digest":{"length":89,"function_hash":"61649420881669196202136751094516715419"},"id":"ASB-A-492683684-6cab56e2","signature_type":"Function"},{"digest":{"function_hash":"91081891884775590369932405568289250434","length":111},"id":"ASB-A-492683684-efc9fee3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"oobDataReceived"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-492683684.json"}},{"package":{"name":"platform/packages/modules/Uwb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"digest":{"length":111,"function_hash":"91081891884775590369932405568289250434"},"id":"ASB-A-492683684-6a6c5c0d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"oobDataReceived"},"deprecated":false},{"digest":{"length":89,"function_hash":"61649420881669196202136751094516715419"},"id":"ASB-A-492683684-7f287d8b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobDisconnected"},"deprecated":false},{"target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["38025574417046419087244872309943817679","219383566330742942559279915631243045000","185135912870555563672284915387580312263","173433282797485490505767597539997242327","29139708090578226915345213323052656609","288042904670986705202418402737485351350","29061413810804428566142432396340218402","97560675729739473506765559568672199436","22464203180503072198750957484607585483","258615435524748204944395670449476632235","308547296153122471018986145785034232414","317284501128887424070738296498326299284","309368015486967817298265376259703181795","281855938897929212484442110318842302836","157710657525854923976036826425446734842","194186333511653472015913527297243387010","315802197048631648983702082296563952662","225917967681048038367711200929891927587","66508598726830257795702347688332316025","20245729583690913768502141576095310351"],"threshold":0.9},"id":"ASB-A-492683684-9ab838be","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898"},{"target":{"function":"deviceOobClosed","file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"},"deprecated":false,"digest":{"function_hash":"61649420881669196202136751094516715419","length":89},"id":"ASB-A-492683684-a1097144","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898"},{"digest":{"function_hash":"61649420881669196202136751094516715419","length":89},"id":"ASB-A-492683684-a4303a65","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898","target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java","function":"deviceOobReconnected"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"61649420881669196202136751094516715419","length":89},"id":"ASB-A-492683684-c7594db8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898","target":{"function":"registerOobSendDataListener","file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-492683684.json"}}],"schema_version":"1.9.0"}