{"id":"ASB-A-504612754","details":"In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-504612754","CVE-2026-49922"],"modified":"2026-11-02T16:56:20.099154142Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"245119199649126703861091156142162242281","length":537},"id":"ASB-A-504612754-95293d79","match_only_versions":["17-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f93b1e37858cc84d29e9daa57fca0d5ff8fd718d","target":{"function":"queryRemoteConnectionServices","file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["116351678834445701071206380721420582045","302353530985646201335380535951438213695","336381818691306038010298984721682917413","161959456169685061143431771943308818010","101092358744341137725637525002484405961","278503811038784378973619098949731536652","55176005618510562308711840013890613482","241788340531073202913362132520032900514","68731918390243616678815821875892029651","68851936220059559151446500334615042661","260091009424696413441674874825254923617","72841479537362505861685449768186199528","113932742328212654938945691421138723194","284341452863539510134188980953020955233","322253896263715952330722050898299726309","181570424070791967675635095282325525041","300317465410289060595603556668785015337","26793227614976471429784599192076533669"]},"id":"ASB-A-504612754-caa3666c","match_only_versions":["17-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f93b1e37858cc84d29e9daa57fca0d5ff8fd718d","target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"}}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/f93b1e37858cc84d29e9daa57fca0d5ff8fd718d"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6557e81b57511166ac0b4352804f5316307dd2f2","target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java","function":"queryRemoteConnectionServices"},"deprecated":false,"digest":{"function_hash":"245119199649126703861091156142162242281","length":537},"id":"ASB-A-504612754-4600c31a","match_only_versions":["15"]},{"target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"},"deprecated":false,"digest":{"line_hashes":["116351678834445701071206380721420582045","302353530985646201335380535951438213695","336381818691306038010298984721682917413","161959456169685061143431771943308818010","101092358744341137725637525002484405961","278503811038784378973619098949731536652","55176005618510562308711840013890613482","241788340531073202913362132520032900514","68731918390243616678815821875892029651","68851936220059559151446500334615042661","260091009424696413441674874825254923617","72841479537362505861685449768186199528","113932742328212654938945691421138723194","284341452863539510134188980953020955233","322253896263715952330722050898299726309","181570424070791967675635095282325525041","300317465410289060595603556668785015337","26793227614976471429784599192076533669"],"threshold":0.9},"id":"ASB-A-504612754-b87e55b7","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6557e81b57511166ac0b4352804f5316307dd2f2"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/6557e81b57511166ac0b4352804f5316307dd2f2"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"},"deprecated":false,"digest":{"line_hashes":["116351678834445701071206380721420582045","302353530985646201335380535951438213695","336381818691306038010298984721682917413","161959456169685061143431771943308818010","101092358744341137725637525002484405961","278503811038784378973619098949731536652","55176005618510562308711840013890613482","241788340531073202913362132520032900514","68731918390243616678815821875892029651","68851936220059559151446500334615042661","260091009424696413441674874825254923617","72841479537362505861685449768186199528","113932742328212654938945691421138723194","284341452863539510134188980953020955233","322253896263715952330722050898299726309","181570424070791967675635095282325525041","300317465410289060595603556668785015337","26793227614976471429784599192076533669"],"threshold":0.9},"id":"ASB-A-504612754-62809b18","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/260368fb70638d1f23fe1668264d6b8ffec2f1c1"},{"match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/260368fb70638d1f23fe1668264d6b8ffec2f1c1","target":{"function":"queryRemoteConnectionServices","file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"},"deprecated":false,"digest":{"function_hash":"245119199649126703861091156142162242281","length":537},"id":"ASB-A-504612754-ba9ccc85"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/260368fb70638d1f23fe1668264d6b8ffec2f1c1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-504612754-037b234d","match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/c07db1c681bb9aa0dfbb0b0263c76a0597f1038f","target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"},"deprecated":false,"digest":{"line_hashes":["116351678834445701071206380721420582045","302353530985646201335380535951438213695","336381818691306038010298984721682917413","161959456169685061143431771943308818010","101092358744341137725637525002484405961","278503811038784378973619098949731536652","55176005618510562308711840013890613482","241788340531073202913362132520032900514","68731918390243616678815821875892029651","68851936220059559151446500334615042661","260091009424696413441674874825254923617","72841479537362505861685449768186199528","113932742328212654938945691421138723194","284341452863539510134188980953020955233","322253896263715952330722050898299726309","181570424070791967675635095282325525041","300317465410289060595603556668785015337","26793227614976471429784599192076533669"],"threshold":0.9}},{"target":{"function":"queryRemoteConnectionServices","file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"},"deprecated":false,"digest":{"length":537,"function_hash":"245119199649126703861091156142162242281"},"id":"ASB-A-504612754-8868fefc","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/c07db1c681bb9aa0dfbb0b0263c76a0597f1038f"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/c07db1c681bb9aa0dfbb0b0263c76a0597f1038f"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/9a75620f4384c2266389c4c06b899e7bae841589"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-504612754-a9870013","match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9a75620f4384c2266389c4c06b899e7bae841589","target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"},"deprecated":false,"digest":{"line_hashes":["116351678834445701071206380721420582045","302353530985646201335380535951438213695","336381818691306038010298984721682917413","161959456169685061143431771943308818010","101092358744341137725637525002484405961","278503811038784378973619098949731536652","55176005618510562308711840013890613482","241788340531073202913362132520032900514","68731918390243616678815821875892029651","68851936220059559151446500334615042661","260091009424696413441674874825254923617","72841479537362505861685449768186199528","113932742328212654938945691421138723194","284341452863539510134188980953020955233","322253896263715952330722050898299726309","181570424070791967675635095282325525041","300317465410289060595603556668785015337","26793227614976471429784599192076533669"],"threshold":0.9}},{"target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java","function":"queryRemoteConnectionServices"},"deprecated":false,"digest":{"length":537,"function_hash":"245119199649126703861091156142162242281"},"id":"ASB-A-504612754-b174db36","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9a75620f4384c2266389c4c06b899e7bae841589"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-504612754.json"}}],"schema_version":"1.9.2"}