{"id":"ASB-A-504573577","details":"In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-504573577","CVE-2026-45528"],"modified":"2026-09-10T15:43:18.983809180Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/47b53f56d755c6dad4485f47ac1991617bbe13c0"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/47b53f56d755c6dad4485f47ac1991617bbe13c0","target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"getManageSpaceActivityIntent"},"deprecated":false,"digest":{"length":1537,"function_hash":"205252167446257727346328416984313230428"},"id":"ASB-A-504573577-1bbf0545","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["117736704502356082521070447074097171566","125490234255071380010985167478587616428","32294471679903276015822303206198258448","260195633351507410969188211581959614743","110840983427967077748798182639788265417","41023389055900421361787190169380042586","117240276386761738484583127818131850446","14411765041829276630199275769454745808","336025351691242334738892371564604563998","194341022521932644254444767754294751258","219036716359787749560571810779249817910","175234704493882289032039541917827817873","96455953260890977068959553820198199624","140230201503450818024476723512408406564","7145919838560446581475917319780354208","109405594789596043724473009359903054006","208543861014975378628340521836993288628","214241911440062925668613920728434439342","157831368993063530271240779107784899911","179122956903572561039772975887837136347","169291628659656215095523778620993742299","76145285988752769522811879006058435872","216698286285820199523426823288555281039","273645741751394518673136531657883770"],"threshold":0.9},"id":"ASB-A-504573577-427e7c7f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/47b53f56d755c6dad4485f47ac1991617bbe13c0","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504573577.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"279526845057031064590492993060815488850","length":1479},"id":"ASB-A-504573577-b142ce2b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c8e476407e6c72f646d533af5efbdb71032363b2","target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"getManageSpaceActivityIntent"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c8e476407e6c72f646d533af5efbdb71032363b2","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false,"digest":{"line_hashes":["117736704502356082521070447074097171566","125490234255071380010985167478587616428","277036211260624291437348441131050707540","108123094975113222445742627900357428163","290842726704363660897265829702452085264","26268570484225686648971501738192220785","14411765041829276630199275769454745808","336025351691242334738892371564604563998","194341022521932644254444767754294751258","219036716359787749560571810779249817910","175234704493882289032039541917827817873","96455953260890977068959553820198199624","140230201503450818024476723512408406564","7145919838560446581475917319780354208","109405594789596043724473009359903054006","208543861014975378628340521836993288628","214241911440062925668613920728434439342","157831368993063530271240779107784899911","179122956903572561039772975887837136347","169291628659656215095523778620993742299","76145285988752769522811879006058435872","216698286285820199523426823288555281039","273645741751394518673136531657883770"],"threshold":0.9},"id":"ASB-A-504573577-d8cc79ab","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c8e476407e6c72f646d533af5efbdb71032363b2"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504573577.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"205252167446257727346328416984313230428","length":1537},"id":"ASB-A-504573577-344b1461","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/20f2dfd9404912b78036823cc56e392031e5846d","target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"getManageSpaceActivityIntent"}},{"digest":{"line_hashes":["117736704502356082521070447074097171566","125490234255071380010985167478587616428","32294471679903276015822303206198258448","260195633351507410969188211581959614743","110840983427967077748798182639788265417","41023389055900421361787190169380042586","117240276386761738484583127818131850446","14411765041829276630199275769454745808","336025351691242334738892371564604563998","194341022521932644254444767754294751258","219036716359787749560571810779249817910","175234704493882289032039541917827817873","96455953260890977068959553820198199624","140230201503450818024476723512408406564","7145919838560446581475917319780354208","109405594789596043724473009359903054006","208543861014975378628340521836993288628","214241911440062925668613920728434439342","157831368993063530271240779107784899911","179122956903572561039772975887837136347","169291628659656215095523778620993742299","76145285988752769522811879006058435872","216698286285820199523426823288555281039","273645741751394518673136531657883770"],"threshold":0.9},"id":"ASB-A-504573577-cc1f29c9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/20f2dfd9404912b78036823cc56e392031e5846d","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/20f2dfd9404912b78036823cc56e392031e5846d"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504573577.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/17874b9db7d3c69ce89fdf5bb5ee778fe3c19d6a"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["117736704502356082521070447074097171566","125490234255071380010985167478587616428","32294471679903276015822303206198258448","260195633351507410969188211581959614743","110840983427967077748798182639788265417","41023389055900421361787190169380042586","117240276386761738484583127818131850446","14411765041829276630199275769454745808","336025351691242334738892371564604563998","194341022521932644254444767754294751258","219036716359787749560571810779249817910","175234704493882289032039541917827817873","96455953260890977068959553820198199624","140230201503450818024476723512408406564","7145919838560446581475917319780354208","109405594789596043724473009359903054006","208543861014975378628340521836993288628","214241911440062925668613920728434439342","157831368993063530271240779107784899911","179122956903572561039772975887837136347","169291628659656215095523778620993742299","76145285988752769522811879006058435872","216698286285820199523426823288555281039","273645741751394518673136531657883770"],"threshold":0.9},"id":"ASB-A-504573577-081b8036","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/17874b9db7d3c69ce89fdf5bb5ee778fe3c19d6a","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}},{"deprecated":false,"digest":{"function_hash":"205252167446257727346328416984313230428","length":1537},"id":"ASB-A-504573577-5ceefc2e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/17874b9db7d3c69ce89fdf5bb5ee778fe3c19d6a","target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"getManageSpaceActivityIntent"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504573577.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["117736704502356082521070447074097171566","125490234255071380010985167478587616428","32294471679903276015822303206198258448","260195633351507410969188211581959614743","110840983427967077748798182639788265417","41023389055900421361787190169380042586","117240276386761738484583127818131850446","14411765041829276630199275769454745808","336025351691242334738892371564604563998","194341022521932644254444767754294751258","219036716359787749560571810779249817910","175234704493882289032039541917827817873","96455953260890977068959553820198199624","140230201503450818024476723512408406564","7145919838560446581475917319780354208","109405594789596043724473009359903054006","208543861014975378628340521836993288628","214241911440062925668613920728434439342","157831368993063530271240779107784899911","179122956903572561039772975887837136347","169291628659656215095523778620993742299","76145285988752769522811879006058435872","216698286285820199523426823288555281039","273645741751394518673136531657883770"]},"id":"ASB-A-504573577-31beb0cf","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/50d6b5520df2ffe73f2bd5f5ee7265c52a0cee9e","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false},{"digest":{"length":1537,"function_hash":"205252167446257727346328416984313230428"},"id":"ASB-A-504573577-f4ece579","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/50d6b5520df2ffe73f2bd5f5ee7265c52a0cee9e","target":{"function":"getManageSpaceActivityIntent","file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/50d6b5520df2ffe73f2bd5f5ee7265c52a0cee9e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504573577.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/31a9b539ed511c875fb470d09a2eda9c4b4874d0","target":{"file":"services/core/java/com/android/server/StorageManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["117736704502356082521070447074097171566","125490234255071380010985167478587616428","277036211260624291437348441131050707540","108123094975113222445742627900357428163","290842726704363660897265829702452085264","26268570484225686648971501738192220785","14411765041829276630199275769454745808","336025351691242334738892371564604563998","194341022521932644254444767754294751258","219036716359787749560571810779249817910","175234704493882289032039541917827817873","96455953260890977068959553820198199624","140230201503450818024476723512408406564","7145919838560446581475917319780354208","109405594789596043724473009359903054006","208543861014975378628340521836993288628","214241911440062925668613920728434439342","157831368993063530271240779107784899911","179122956903572561039772975887837136347","169291628659656215095523778620993742299","76145285988752769522811879006058435872","216698286285820199523426823288555281039","273645741751394518673136531657883770"]},"id":"ASB-A-504573577-2c1c93ca","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-504573577-c817cfca","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/31a9b539ed511c875fb470d09a2eda9c4b4874d0","target":{"file":"services/core/java/com/android/server/StorageManagerService.java","function":"getManageSpaceActivityIntent"},"deprecated":false,"digest":{"length":1479,"function_hash":"279526845057031064590492993060815488850"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/31a9b539ed511c875fb470d09a2eda9c4b4874d0"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504573577.json"}}],"schema_version":"1.9.0"}