{"id":"ASB-A-507575871","details":"In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-507575871","CVE-2026-28658"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6a2d8b6bc382fa5dc845650d3a47176efa0ef554","target":{"function":"findMetaAuthUid","file":"services/core/java/com/android/server/accounts/AccountsDb.java"},"deprecated":false,"digest":{"function_hash":"214884600998675636459233104184776894002","length":835},"id":"ASB-A-507575871-25750707"},{"digest":{"threshold":0.9,"line_hashes":["145846812891764339617439909658596855819","36247804971271176721404609721789626033","309472771607039647252752725677737594933","188687346634811302480631272334728679162","48560736277134926536525914687556358538","329534993615049278268322453974420969707","100438875036151586299867983787764500487","73898767245209920450383611738606157548","71044382201136563276894606252199556150"]},"id":"ASB-A-507575871-61d076c6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6a2d8b6bc382fa5dc845650d3a47176efa0ef554","target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6a2d8b6bc382fa5dc845650d3a47176efa0ef554"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-507575871.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"},"deprecated":false,"digest":{"line_hashes":["145846812891764339617439909658596855819","36247804971271176721404609721789626033","309472771607039647252752725677737594933","105184994290666824993970154764502399744","48560736277134926536525914687556358538","329534993615049278268322453974420969707","100438875036151586299867983787764500487","73898767245209920450383611738606157548","71044382201136563276894606252199556150"],"threshold":0.9},"id":"ASB-A-507575871-64a8dd60","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9d93fc6dc1a4c4e71c6be4423e002934500fcc4f"},{"target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java","function":"findMetaAuthUid"},"deprecated":false,"digest":{"function_hash":"214884600998675636459233104184776894002","length":835},"id":"ASB-A-507575871-aa9ad87e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9d93fc6dc1a4c4e71c6be4423e002934500fcc4f"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9d93fc6dc1a4c4e71c6be4423e002934500fcc4f"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-507575871.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/67c5dd4a7a88112d1b4b6b813a8f53a17c24f46d"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["145846812891764339617439909658596855819","36247804971271176721404609721789626033","309472771607039647252752725677737594933","105184994290666824993970154764502399744","48560736277134926536525914687556358538","329534993615049278268322453974420969707","100438875036151586299867983787764500487","73898767245209920450383611738606157548","71044382201136563276894606252199556150"]},"id":"ASB-A-507575871-d4003a6d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/67c5dd4a7a88112d1b4b6b813a8f53a17c24f46d","target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/67c5dd4a7a88112d1b4b6b813a8f53a17c24f46d","target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java","function":"findMetaAuthUid"},"deprecated":false,"digest":{"function_hash":"214884600998675636459233104184776894002","length":835},"id":"ASB-A-507575871-ff97668c"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-507575871.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cb21bacf45ab1077423520552ea2969071f5fd28"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cb21bacf45ab1077423520552ea2969071f5fd28","target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java","function":"findMetaAuthUid"},"deprecated":false,"digest":{"function_hash":"214884600998675636459233104184776894002","length":835},"id":"ASB-A-507575871-3dd81ad3","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["145846812891764339617439909658596855819","36247804971271176721404609721789626033","309472771607039647252752725677737594933","105184994290666824993970154764502399744","48560736277134926536525914687556358538","329534993615049278268322453974420969707","100438875036151586299867983787764500487","73898767245209920450383611738606157548","71044382201136563276894606252199556150"]},"id":"ASB-A-507575871-d6eaea11","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cb21bacf45ab1077423520552ea2969071f5fd28","target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-507575871.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-507575871-552efad2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b8d9ce94c8ba0a10cc105655ce5bffca415f098c","target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"},"deprecated":false,"digest":{"line_hashes":["145846812891764339617439909658596855819","36247804971271176721404609721789626033","309472771607039647252752725677737594933","188687346634811302480631272334728679162","48560736277134926536525914687556358538","329534993615049278268322453974420969707","100438875036151586299867983787764500487","73898767245209920450383611738606157548","71044382201136563276894606252199556150"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b8d9ce94c8ba0a10cc105655ce5bffca415f098c","target":{"function":"findMetaAuthUid","file":"services/core/java/com/android/server/accounts/AccountsDb.java"},"deprecated":false,"digest":{"function_hash":"214884600998675636459233104184776894002","length":835},"id":"ASB-A-507575871-d4adafd7"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b8d9ce94c8ba0a10cc105655ce5bffca415f098c"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-507575871.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"},"deprecated":false,"digest":{"line_hashes":["145846812891764339617439909658596855819","36247804971271176721404609721789626033","309472771607039647252752725677737594933","105184994290666824993970154764502399744","48560736277134926536525914687556358538","329534993615049278268322453974420969707","100438875036151586299867983787764500487","73898767245209920450383611738606157548","71044382201136563276894606252199556150"],"threshold":0.9},"id":"ASB-A-507575871-207f3ef5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ea8f06108405df08d3a1615c92bc71b5d6889781"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ea8f06108405df08d3a1615c92bc71b5d6889781","target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java","function":"findMetaAuthUid"},"deprecated":false,"digest":{"function_hash":"214884600998675636459233104184776894002","length":835},"id":"ASB-A-507575871-dd68d363","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ea8f06108405df08d3a1615c92bc71b5d6889781"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-507575871.json"}}],"schema_version":"1.9.0"}