{"id":"ASB-A-500368515","details":"In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-500368515","CVE-2026-58957"],"modified":"2026-11-02T17:11:25.910532335Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/038570272e1bffb436ba462a17019ee1591e6ea2","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveToHeavyWeightSwitcherIfNeeded"},"deprecated":false,"digest":{"function_hash":"208541534460384948833338299093157541976","length":2513},"id":"ASB-A-500368515-2e881220"},{"target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"line_hashes":["262393294667374548033073179435608603727","185767816261428529599732507358338687409","2794047396836808824727809203415499785","328319832459946279802342749576007426665","76711921162984927464940564694963012342","114453219737195865279216126144651768457","127969907326923251870947243259122396355","177747119237921070628884928215625249740","251165073482809034947053272683998112528","335217149137500581974031050117146731004","188787713035632447775610434457095139296","284865945246284946780412976973192343533","147702096036081541563886442426695764811","95324265733025569373517630511986400327","264129475696548534827926576125744390365","246966273701212530409304353138918305123","113757763372197570081243132480577431092"],"threshold":0.9},"id":"ASB-A-500368515-348ada24","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/038570272e1bffb436ba462a17019ee1591e6ea2"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/038570272e1bffb436ba462a17019ee1591e6ea2"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["121627612520486245863375107390968337961","293768016984612675264427475236103031404","2794047396836808824727809203415499785","328319832459946279802342749576007426665","76711921162984927464940564694963012342","114453219737195865279216126144651768457","127969907326923251870947243259122396355","177747119237921070628884928215625249740","338460634918020054896853830242271131569","31954128021861864275942091384272148764","290241155291904266061664649701699576592","206134399752924949617700129147085569876","147702096036081541563886442426695764811","95324265733025569373517630511986400327","264129475696548534827926576125744390365","246966273701212530409304353138918305123","113757763372197570081243132480577431092"]},"id":"ASB-A-500368515-4273cc51","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fd53cee662011b8c941ed128c46da310c01d5625","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}},{"target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveToHeavyWeightSwitcherIfNeeded"},"deprecated":false,"digest":{"function_hash":"168741367883641637588844732969743879242","length":2536},"id":"ASB-A-500368515-61f07508","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fd53cee662011b8c941ed128c46da310c01d5625"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fd53cee662011b8c941ed128c46da310c01d5625"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/842a7d49c6355280a3e60ff55bd3798a4ba6ba0f","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"line_hashes":["262393294667374548033073179435608603727","185767816261428529599732507358338687409","2794047396836808824727809203415499785","328319832459946279802342749576007426665","76711921162984927464940564694963012342","114453219737195865279216126144651768457","127969907326923251870947243259122396355","177747119237921070628884928215625249740","338460634918020054896853830242271131569","31954128021861864275942091384272148764","290241155291904266061664649701699576592","206134399752924949617700129147085569876","147702096036081541563886442426695764811","95324265733025569373517630511986400327","264129475696548534827926576125744390365","246966273701212530409304353138918305123","113757763372197570081243132480577431092"],"threshold":0.9},"id":"ASB-A-500368515-91401fe5","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"168741367883641637588844732969743879242","length":2536},"id":"ASB-A-500368515-dd607f97","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/842a7d49c6355280a3e60ff55bd3798a4ba6ba0f","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveToHeavyWeightSwitcherIfNeeded"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/842a7d49c6355280a3e60ff55bd3798a4ba6ba0f"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7dfe78705e17c1fcc80bba541910516369d7579e"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-500368515-5189ea5e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7dfe78705e17c1fcc80bba541910516369d7579e","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveToHeavyWeightSwitcherIfNeeded"},"deprecated":false,"digest":{"length":2536,"function_hash":"168741367883641637588844732969743879242"}},{"deprecated":false,"digest":{"line_hashes":["262393294667374548033073179435608603727","185767816261428529599732507358338687409","2794047396836808824727809203415499785","328319832459946279802342749576007426665","76711921162984927464940564694963012342","114453219737195865279216126144651768457","127969907326923251870947243259122396355","177747119237921070628884928215625249740","338460634918020054896853830242271131569","31954128021861864275942091384272148764","290241155291904266061664649701699576592","206134399752924949617700129147085569876","147702096036081541563886442426695764811","95324265733025569373517630511986400327","264129475696548534827926576125744390365","246966273701212530409304353138918305123","113757763372197570081243132480577431092"],"threshold":0.9},"id":"ASB-A-500368515-72e36dc5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7dfe78705e17c1fcc80bba541910516369d7579e","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-500368515-50c14f21","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9391d85900cc3200fa14f6bc1ca52932454c0ab","target":{"function":"resolveToHeavyWeightSwitcherIfNeeded","file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"function_hash":"208541534460384948833338299093157541976","length":2513}},{"target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"line_hashes":["262393294667374548033073179435608603727","185767816261428529599732507358338687409","2794047396836808824727809203415499785","328319832459946279802342749576007426665","76711921162984927464940564694963012342","114453219737195865279216126144651768457","127969907326923251870947243259122396355","177747119237921070628884928215625249740","251165073482809034947053272683998112528","335217149137500581974031050117146731004","188787713035632447775610434457095139296","284865945246284946780412976973192343533","147702096036081541563886442426695764811","95324265733025569373517630511986400327","264129475696548534827926576125744390365","246966273701212530409304353138918305123","113757763372197570081243132480577431092"],"threshold":0.9},"id":"ASB-A-500368515-c5d34457","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9391d85900cc3200fa14f6bc1ca52932454c0ab"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f9391d85900cc3200fa14f6bc1ca52932454c0ab"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53f78b87480a894abb2806a2b101a91fced08d33","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"},"deprecated":false,"digest":{"line_hashes":["121627612520486245863375107390968337961","293768016984612675264427475236103031404","2794047396836808824727809203415499785","328319832459946279802342749576007426665","76711921162984927464940564694963012342","114453219737195865279216126144651768457","127969907326923251870947243259122396355","177747119237921070628884928215625249740","338460634918020054896853830242271131569","31954128021861864275942091384272148764","290241155291904266061664649701699576592","206134399752924949617700129147085569876","147702096036081541563886442426695764811","95324265733025569373517630511986400327","264129475696548534827926576125744390365","246966273701212530409304353138918305123","113757763372197570081243132480577431092"],"threshold":0.9},"id":"ASB-A-500368515-7464727b","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53f78b87480a894abb2806a2b101a91fced08d33","target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java","function":"resolveToHeavyWeightSwitcherIfNeeded"},"deprecated":false,"digest":{"function_hash":"168741367883641637588844732969743879242","length":2536},"id":"ASB-A-500368515-c4667edd","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/53f78b87480a894abb2806a2b101a91fced08d33"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-500368515.json"}}],"schema_version":"1.9.2"}