{"id":"ASB-A-497544808","details":"In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-497544808","CVE-2026-28611"],"modified":"2026-09-08T15:39:03.104189951Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"target":{"function":"setReaderMode","file":"NfcNci/src/com/android/nfc/NfcService.java"},"deprecated":false,"digest":{"length":3151,"function_hash":"145683630974362096072968605857705983066"},"id":"ASB-A-497544808-591cb063","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040","target":{"function":"setObserveMode","file":"NfcNci/src/com/android/nfc/NfcService.java"},"deprecated":false,"digest":{"function_hash":"237234351477676370667634539421276327217","length":2101},"id":"ASB-A-497544808-5c78cc4c","signature_type":"Function"},{"target":{"file":"NfcNci/src/com/android/nfc/NfcService.java","function":"disable"},"deprecated":false,"digest":{"function_hash":"265777529305273559796576123193308485775","length":1240},"id":"ASB-A-497544808-a783f63a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040"},{"target":{"file":"NfcNci/src/com/android/nfc/NfcService.java","function":"enable"},"deprecated":false,"digest":{"function_hash":"239122068815507389811696308729534070105","length":1666},"id":"ASB-A-497544808-afc424bc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040"},{"digest":{"function_hash":"261696602871462327323971925813227222894","length":4208},"id":"ASB-A-497544808-c2bf5fd9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040","target":{"file":"NfcNci/src/com/android/nfc/NfcService.java","function":"updateDiscoveryTechnology"},"deprecated":false},{"target":{"function":"indicateDataMigration","file":"NfcNci/src/com/android/nfc/NfcService.java"},"deprecated":false,"digest":{"length":616,"function_hash":"92368584954975034970821966423706717393"},"id":"ASB-A-497544808-c5bf3078","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040"},{"target":{"file":"NfcNci/src/com/android/nfc/NfcService.java"},"deprecated":false,"digest":{"line_hashes":["69205547113887266068518823224605502267","223840672871161281574186763545393098309","252403233024895884755194562494749533092","5944225885217768981174676348504078912","86023815439605145093715809987945259005","82975587123365214081206607249417658","325758782967844088286221920727569750221","26061156286725583050350185489114847447","189036049833329939188541568722233512569","5944225885217768981174676348504078912","86023815439605145093715809987945259005","82975587123365214081206607249417658","191303302751989509012046826745326591411","71206970072727764472179681134870851206","278995233214764222220983802419778036455","322260598877903237889138085121648349823","63347763038648270700707724389435817852","241439289263365029563955214458572132899","146138177818502707739664887339077044230","49492440979189719781086095979495023592","81858657170600474943572318080930234062","60448725326329302658509307918809406709","294872942792411638511868819279631651856","211535723430463090126709567016729928356","118426360523720135475786508033925427186","257676172060963152924892957730751204968","81858657170600474943572318080930234062","150312388581316878391767366313334151868","226886623327191727632172985324627866722","10088064794857335950242766556883115608","251396540005101835005974386287738425816","197364854751080878007150759032904307380","236698731208856873077628429925431946120","5331249002279309185002535410000684742","79974554043902973053202358796376875474","18108656312709554699160905968840516889"],"threshold":0.9},"id":"ASB-A-497544808-f1c16025","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-497544808.json"}},{"package":{"name":"platform/packages/apps/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"128026890074346895050553221364004724732","length":1971},"id":"ASB-A-497544808-1f9678c6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9","target":{"file":"src/com/android/nfc/NfcService.java","function":"setObserveMode"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9","target":{"file":"src/com/android/nfc/NfcPermissions.java","function":"NfcPermissions"},"deprecated":false,"digest":{"function_hash":"128268047118787842790280521556671856318","length":47},"id":"ASB-A-497544808-2b6105e4","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9","target":{"file":"src/com/android/nfc/NfcService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["45216410068772303476179510506710438591","42225182403007286670159495166329417411","285947112621472329395811251621730932101","198668885382374481451112312706876850291","294218935381908821537056423525558823820","272655404112960425583652546923187180015","3740093818984911944090468567441465362","28048474000066755449228687525090511900","103662245915556943784179512227706888254","116488047471259479470762969900484057071","238885325020635941023712010175219965721","135991937613766438531817900831988694922"]},"id":"ASB-A-497544808-48c2bf06","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9","target":{"file":"src/com/android/nfc/NfcService.java","function":"disable"},"deprecated":false,"digest":{"function_hash":"324323340451671305577626903777163313287","length":892},"id":"ASB-A-497544808-4adf2bfa","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9","target":{"function":"enable","file":"src/com/android/nfc/NfcService.java"},"deprecated":false,"digest":{"function_hash":"126493090679821232874191917315963087065","length":1195},"id":"ASB-A-497544808-b3abbd6b","signature_type":"Function"},{"target":{"file":"src/com/android/nfc/NfcPermissions.java"},"deprecated":false,"digest":{"line_hashes":["7532320810051387249591001405386457390","75340458277115490981875896555826603649","6811014069132401629002944300020367163","329050400345450364928837027295116904414","184728700489855773840354683261854473198","157313238185269734371328083852511581439","97926044348150109862872479918366346863","264261439526995264911649148160513103392","183294740712613140801359953412122588019","202256548282891204996427824974724142654","246239478320250421325549291732446786869","91110940583516536628521317555625609168"],"threshold":0.9},"id":"ASB-A-497544808-e4ae95c8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-497544808.json"}},{"package":{"name":"platform/packages/modules/Nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"NfcNci/src/com/android/nfc/NfcService.java","function":"setObserveMode"},"deprecated":false,"digest":{"length":2101,"function_hash":"237234351477676370667634539421276327217"},"id":"ASB-A-497544808-16e47bcf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89","target":{"file":"NfcNci/src/com/android/nfc/NfcService.java","function":"indicateDataMigration"},"deprecated":false,"digest":{"length":616,"function_hash":"92368584954975034970821966423706717393"},"id":"ASB-A-497544808-2a893363","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89","target":{"function":"updateDiscoveryTechnology","file":"NfcNci/src/com/android/nfc/NfcService.java"},"deprecated":false,"digest":{"length":4236,"function_hash":"282740423134334196702566285651825695021"},"id":"ASB-A-497544808-4ac80df0","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89","target":{"file":"NfcNci/src/com/android/nfc/NfcService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["69205547113887266068518823224605502267","223840672871161281574186763545393098309","252403233024895884755194562494749533092","5944225885217768981174676348504078912","86023815439605145093715809987945259005","82975587123365214081206607249417658","325758782967844088286221920727569750221","26061156286725583050350185489114847447","189036049833329939188541568722233512569","5944225885217768981174676348504078912","86023815439605145093715809987945259005","82975587123365214081206607249417658","191303302751989509012046826745326591411","71206970072727764472179681134870851206","278995233214764222220983802419778036455","322260598877903237889138085121648349823","63347763038648270700707724389435817852","241439289263365029563955214458572132899","146138177818502707739664887339077044230","49492440979189719781086095979495023592","81858657170600474943572318080930234062","60448725326329302658509307918809406709","294872942792411638511868819279631651856","211535723430463090126709567016729928356","118426360523720135475786508033925427186","257676172060963152924892957730751204968","81858657170600474943572318080930234062","150312388581316878391767366313334151868","226886623327191727632172985324627866722","10088064794857335950242766556883115608","251396540005101835005974386287738425816","197364854751080878007150759032904307380","236698731208856873077628429925431946120","5331249002279309185002535410000684742","79974554043902973053202358796376875474","18108656312709554699160905968840516889"]},"id":"ASB-A-497544808-99d7b66d","signature_type":"Line","signature_version":"v1"},{"target":{"file":"NfcNci/src/com/android/nfc/NfcService.java","function":"enable"},"deprecated":false,"digest":{"function_hash":"313129892655125198357375658641930504441","length":1680},"id":"ASB-A-497544808-bd9486fb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89"},{"digest":{"function_hash":"73479498194997688904024993702543971352","length":3017},"id":"ASB-A-497544808-bdc7688c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89","target":{"file":"NfcNci/src/com/android/nfc/NfcService.java","function":"setReaderMode"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89","target":{"file":"NfcNci/src/com/android/nfc/NfcService.java","function":"disable"},"deprecated":false,"digest":{"function_hash":"249839188500909481740527359787784670808","length":1254},"id":"ASB-A-497544808-d98b3bc0","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-497544808.json"}}],"schema_version":"1.9.0"}