{"id":"ASB-A-498916138","details":"In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-498916138","CVE-2026-28657"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e2c75d70260ad97f24feef6b8ec1a0ebfe364347","target":{"function":"onActivityResult","file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java"},"deprecated":false,"digest":{"function_hash":"311704568954905544218201527300819541202","length":286},"id":"ASB-A-498916138-6cd6a46e","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e2c75d70260ad97f24feef6b8ec1a0ebfe364347","target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java"},"deprecated":false,"digest":{"line_hashes":["237016630149306421452840928473007703053","50143385128495565907010397505966602007","88100196006281129937411128248127776562","140559082213086012803180817233321705467","228608869399389294870407046796633210727","74252292172099829220238198815578687459","224263778142613551284112330002219923970","175302810258537392142677048446428414616","84568215179344273222986484452005504446","282088641526453108010441287455962860942","4852878632377954103182448372210044214"],"threshold":0.9},"id":"ASB-A-498916138-c290cb35"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e2c75d70260ad97f24feef6b8ec1a0ebfe364347"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498916138.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7c0b971945321ee139c71abb27c77732737c5b0f"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["175302810258537392142677048446428414616","84568215179344273222986484452005504446","282088641526453108010441287455962860942","4852878632377954103182448372210044214"],"threshold":0.9},"id":"ASB-A-498916138-0802f198","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7c0b971945321ee139c71abb27c77732737c5b0f","target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"311704568954905544218201527300819541202","length":286},"id":"ASB-A-498916138-e37995a4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7c0b971945321ee139c71abb27c77732737c5b0f","target":{"function":"onActivityResult","file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498916138.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["237016630149306421452840928473007703053","50143385128495565907010397505966602007","88100196006281129937411128248127776562","140559082213086012803180817233321705467","228608869399389294870407046796633210727","74252292172099829220238198815578687459","224263778142613551284112330002219923970","175302810258537392142677048446428414616","84568215179344273222986484452005504446","282088641526453108010441287455962860942","4852878632377954103182448372210044214"],"threshold":0.9},"id":"ASB-A-498916138-31760a5b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/80e84dab91f60a4c7175759802b30d4ad3241c39","target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/80e84dab91f60a4c7175759802b30d4ad3241c39","target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java","function":"onActivityResult"},"deprecated":false,"digest":{"length":286,"function_hash":"311704568954905544218201527300819541202"},"id":"ASB-A-498916138-a71eb1a6","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/80e84dab91f60a4c7175759802b30d4ad3241c39"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-498916138.json"}}],"schema_version":"1.9.0"}