{"id":"ASB-A-505203996","details":"In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-505203996","CVE-2026-55289"],"modified":"2026-11-02T16:56:28.390470929Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"function":"isPrivilegedDialerCalling","file":"src/com/android/server/telecom/TelecomServiceImpl.java"},"deprecated":false,"digest":{"function_hash":"330315130932522360784747181487816530920","length":287},"id":"ASB-A-505203996-1ed81ab6","match_only_versions":["17-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634"},{"target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java","function":"canCallPhone"},"deprecated":false,"digest":{"length":407,"function_hash":"295712094137804635205810278931496000458"},"id":"ASB-A-505203996-33e80638","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634"},{"digest":{"threshold":0.9,"line_hashes":["86278727861197139604671893229060424621","103766434882346259814728050165405437505","234504008221683615009177537819868366400","92515587208316795308991249841478771306","69716668344983655770162293817504341487","48416785219082061250808708873163493378","45650031370359766663826475779683718154","142987263936802276706160726272810418353","193628616257204987446523787817527616332","309369494472123450681838919540963304045","218369141499899838781240123060173072054","6249721980892984414849712123497377303","243536576043052723022382113460783169736","80451506911237754867416745900263328170","80724333720435303056576763340845266400","319011713610100120864939992360009683939","12001071865962451999073060072627413515","257658228199479444816923161032889276286","35240001829098591109843888949307083210"]},"id":"ASB-A-505203996-42c8c6bc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634","target":{"file":"shim/src/com/android/server/telecom/components/UserCallActivity.java"},"deprecated":false},{"match_only_versions":["17-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634","target":{"file":"src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java"},"deprecated":false,"digest":{"line_hashes":["50695453196511917667382222915167439542","272086397273914182336634860434661176822","200698477459139337055977027095292128212","90141269349917598685359379552506181967"],"threshold":0.9},"id":"ASB-A-505203996-5eaf0ae2"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634","target":{"file":"src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java","function":"evaluateCall"},"deprecated":false,"digest":{"length":3395,"function_hash":"323176036711350709855376518473680491912"},"id":"ASB-A-505203996-6b4848cb","match_only_versions":["17-qpr2-next"]},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634","target":{"function":"onCreate","file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java"},"deprecated":false,"digest":{"length":513,"function_hash":"331385506515775265558732758139538512725"},"id":"ASB-A-505203996-6f782566","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["174158765299844124862182486439794315587","294865490144327236354505462175307729585","154701552172875255828056385180029400413","282100032885274639554194341970058983963","171124136203903482151304339303388538750","212198880264034643598445223044439501437","206458414995876812280768179639101306925","329391719045896626815104727658732290078","252716857351176541831830684124242156724","223353076577811774688916603567421288556","334003929268480117611375380446140343729","226454840075806144798465516219575123924","291169693121892326246353889426833768395","184026378660447282904299984341827822005","142878841133625634987164990152496923377","199398547060826680043193663774472747630","335648399029946842055827149653375901290","106819061933740884976984181160246624859","213651187607373246609274529685428814716","141391334662881615769053942429005152198","250052718377858165254528258080305220096","281299525101955639516243683589380377121","126470771980775024067872490708988041849","108587633537507210242609878158511307392"]},"id":"ASB-A-505203996-774663b4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634","target":{"file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634","target":{"file":"shim/src/com/android/server/telecom/components/UserCallActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"240605221182393886588539899514619758048","length":402},"id":"ASB-A-505203996-b5ae9364","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634","target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["211606276810484770850335400062363720648","208029519138830534075153600342797647095","49910670201577065668438323373258281225","212449657643427366064019303224402410465","200433922445479970685364476649083516722","37466961728406674403279944156737363576","128040321331304509027012639690330862672","84665339305936974132918708462822274898","198653903060236862370455849760178000090","267780876264562307033453634237472480254","245002908388018266800826644200589145972","151166777004075194442125827304301777280","226138919854692382020361725630530615925","306064304924570502954231156251315144581","123787832335589096071169277345227123243","43163942321134570520094006480075930320","231062644332274203393143252018489583210","65900374074704959880361816702164331516","1940933418998956496677517011395907334","290257482944060423318858568018666373918","42861667117885092653915698266671293744","325237034809324114931913038604212543510","42687180638943089901085023415870552346","229091512329938673298048244250437767090","39437940744165216598041809419395730966","49972917257305688207505237252462705470","168846663661885879776292167690822831118","19942330904931449819666157497822824989","5352145155968974949146155114994691872","71213782818208411621331524956476590892","74125085547040839270481520649481066054","216759101321050414572302443584326964221","313716507106706704845400636629083467301","115700971515451193416402783396439007461","1100794366951065722690305627346689872","334910930580624831346148765740764517425","205207896246053102986634230757109838338","74641304081934351207167371350069938556","335777800183651497369059224788356919682","172310961955298760571850989084888564608","167440586512384540725453599750191482598","101065513537398550422398073860005781861","132358025902736832135776783458677104372","23223460542096636811488640541404017453","175898472054875948418032079417714943765","240038912123859328756881310510379930081","230596331461920213185110415673702975716","262349375935787992936486003242721178693","42008630169433739829497722439383527278","214970976169313070613719100687100639671","202557024206086899536646162163561932232","237962361949789119224438660020119595466","28596955379224888003298913676426171137","237373438958482878177039912373166182267","45822501124873862512616495515827442413","335943456201435223554115798408444771743","105629498571838687917492431227196817296","124133484266256358898672596735952455270","332440396655864344600237596462501881406","170861106833961075340615141014447051417","100295546031401840307877216740584035038"]},"id":"ASB-A-505203996-d1b104c2"},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634","target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java","function":"placeCall"},"deprecated":false,"digest":{"function_hash":"71842551649817028901445745690455959475","length":2199},"id":"ASB-A-505203996-f6fff2ef","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505203996.json"}},{"package":{"name":"platform/packages/services/Telecomm","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-505203996-003ce308","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java","function":"placeCall"},"deprecated":false,"digest":{"function_hash":"71842551649817028901445745690455959475","length":2199}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["252716857351176541831830684124242156724","223353076577811774688916603567421288556","334003929268480117611375380446140343729","226454840075806144798465516219575123924","199398547060826680043193663774472747630","335648399029946842055827149653375901290","106819061933740884976984181160246624859","213651187607373246609274529685428814716","141391334662881615769053942429005152198","250052718377858165254528258080305220096","281299525101955639516243683589380377121","126470771980775024067872490708988041849","108587633537507210242609878158511307392"]},"id":"ASB-A-505203996-11bb61aa"},{"deprecated":false,"digest":{"length":91,"function_hash":"1191534197891038414758743629728348917"},"id":"ASB-A-505203996-2e9c78e0","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java","function":"canCallPhone"}},{"id":"ASB-A-505203996-61018b70","match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["50695453196511917667382222915167439542","272086397273914182336634860434661176822","200698477459139337055977027095292128212","90141269349917598685359379552506181967"]}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"shim/src/com/android/server/telecom/components/UserCallActivity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["92515587208316795308991249841478771306","69716668344983655770162293817504341487","48416785219082061250808708873163493378","243536576043052723022382113460783169736","80451506911237754867416745900263328170","80724333720435303056576763340845266400","319011713610100120864939992360009683939"]},"id":"ASB-A-505203996-6f1231cf","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"331385506515775265558732758139538512725","length":513},"id":"ASB-A-505203996-715dfc7e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"function":"onCreate","file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java"}},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"shim/src/com/android/server/telecom/components/UserCallActivity.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"240605221182393886588539899514619758048","length":402},"id":"ASB-A-505203996-79e1e6cd","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"330315130932522360784747181487816530920","length":287},"id":"ASB-A-505203996-8bd22a5e","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java","function":"isPrivilegedDialerCalling"}},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java","function":"evaluateCall"},"deprecated":false,"digest":{"function_hash":"323176036711350709855376518473680491912","length":3395},"id":"ASB-A-505203996-c12aefd4","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["200433922445479970685364476649083516722","37466961728406674403279944156737363576","128040321331304509027012639690330862672","84665339305936974132918708462822274898","198653903060236862370455849760178000090","267780876264562307033453634237472480254","65900374074704959880361816702164331516","1940933418998956496677517011395907334","290257482944060423318858568018666373918","42861667117885092653915698266671293744","325237034809324114931913038604212543510","42687180638943089901085023415870552346","229091512329938673298048244250437767090","39437940744165216598041809419395730966","49972917257305688207505237252462705470","168846663661885879776292167690822831118","19942330904931449819666157497822824989","5352145155968974949146155114994691872","71213782818208411621331524956476590892","74125085547040839270481520649481066054","216759101321050414572302443584326964221","313716507106706704845400636629083467301","115700971515451193416402783396439007461","1100794366951065722690305627346689872","334910930580624831346148765740764517425","205207896246053102986634230757109838338","74641304081934351207167371350069938556","335777800183651497369059224788356919682","172310961955298760571850989084888564608","167440586512384540725453599750191482598","101065513537398550422398073860005781861","132358025902736832135776783458677104372","13185319101264593172080308982356280931","143606030375037241194193185918268659158","311557270563434180769956070890341126138","23223460542096636811488640541404017453","175898472054875948418032079417714943765","240038912123859328756881310510379930081","230596331461920213185110415673702975716","262349375935787992936486003242721178693","42008630169433739829497722439383527278","214970976169313070613719100687100639671","202557024206086899536646162163561932232","237962361949789119224438660020119595466","28596955379224888003298913676426171137","237373438958482878177039912373166182267","45822501124873862512616495515827442413","105629498571838687917492431227196817296","124133484266256358898672596735952455270","332440396655864344600237596462501881406","170861106833961075340615141014447051417","100295546031401840307877216740584035038"],"threshold":0.9},"id":"ASB-A-505203996-cdb7475c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java"}},{"source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b","target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java","function":"canCallPhone"},"deprecated":false,"digest":{"function_hash":"295712094137804635205810278931496000458","length":407},"id":"ASB-A-505203996-d5d49f3f","signature_type":"Function","signature_version":"v1"},{"target":{"file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java","function":"verifyCallAction"},"deprecated":false,"digest":{"function_hash":"297037854016735136514187153206101819123","length":317},"id":"ASB-A-505203996-e92e0ac4","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505203996.json"}}],"schema_version":"1.9.2"}