{"id":"ASB-A-496735702","details":"In onServiceConnected of HostEmulationManager.java, there is a possible way to perform BAL due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-496735702","CVE-2026-28574"],"modified":"2026-06-11T14:59:52.052110020Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Nfc/+/477d0eb9f0f6ff7c0d40b7c19ce71aa4a294dc13"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea","match_only_versions":["17-next"],"id":"ASB-A-496735702-24692715","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["86688120992371390739020006842299055484","215223423322781899579547143707049384550","275464154574438694425345713387515178782","326020092990932437683134700065233243053"]}},{"target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onServiceConnected"},"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea","match_only_versions":["17-next"],"id":"ASB-A-496735702-b9aef8bb","signature_type":"Function","digest":{"function_hash":"141656006104620151990289342286865021790","length":1988}}],"types":["EoP"],"severity":"High","fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea"],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496735702.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["33761003995606516348867317978512480547","264491105238813284431707904219229667689","231588233561071738439720740133199140598","303451526792491032741878816960172378737"]},"target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e","signature_version":"v1","id":"ASB-A-496735702-b801f6c5","signature_type":"Line"},{"digest":{"length":1774,"function_hash":"154034435489838502234758318852156583301"},"target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onServiceConnected"},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e","deprecated":false,"id":"ASB-A-496735702-d5f65333","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e"],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496735702.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","types":["EoP"],"vanir_signatures":[{"target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"},"match_only_versions":["16-qpr2"],"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e","deprecated":false,"id":"ASB-A-496735702-734cadce","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["86688120992371390739020006842299055484","215223423322781899579547143707049384550","275464154574438694425345713387515178782","326020092990932437683134700065233243053"]}},{"digest":{"function_hash":"247534031965832360392989219577962126912","length":1789},"target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java","function":"onServiceConnected"},"deprecated":false,"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e","signature_version":"v1","id":"ASB-A-496735702-f40910d8","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e"],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496735702.json"}}],"schema_version":"1.7.5"}