{"id":"ASB-A-496735702","details":"In onServiceConnected of HostEmulationManager.java, there is a possible way to perform BAL due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-496735702","CVE-2026-28574"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Nfc/+/477d0eb9f0f6ff7c0d40b7c19ce71aa4a294dc13"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea"],"severity":"High","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["86688120992371390739020006842299055484","215223423322781899579547143707049384550","275464154574438694425345713387515178782","326020092990932437683134700065233243053"]},"id":"ASB-A-496735702-24692715","match_only_versions":["17-next"],"signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onServiceConnected"},"deprecated":false,"digest":{"length":1988,"function_hash":"141656006104620151990289342286865021790"},"id":"ASB-A-496735702-b9aef8bb","match_only_versions":["17-next"]}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496735702.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"digest":{"line_hashes":["33761003995606516348867317978512480547","264491105238813284431707904219229667689","231588233561071738439720740133199140598","303451526792491032741878816960172378737"],"threshold":0.9},"id":"ASB-A-496735702-b801f6c5","signature_type":"Line"},{"deprecated":false,"digest":{"length":1774,"function_hash":"154034435489838502234758318852156583301"},"id":"ASB-A-496735702-d5f65333","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onServiceConnected"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496735702.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["86688120992371390739020006842299055484","215223423322781899579547143707049384550","275464154574438694425345713387515178782","326020092990932437683134700065233243053"]},"id":"ASB-A-496735702-734cadce","match_only_versions":["16-qpr2"]},{"id":"ASB-A-496735702-f40910d8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e","target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onServiceConnected"},"deprecated":false,"digest":{"function_hash":"247534031965832360392989219577962126912","length":1789}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e"],"severity":"High","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496735702.json"}}],"schema_version":"1.9.0"}