{"id":"ASB-A-517377154","details":"In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-517377154","CVE-2026-55270"],"modified":"2026-10-05T16:56:07.499222215Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-517377154-290421eb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java","function":"dialInternal"},"deprecated":false,"digest":{"length":1700,"function_hash":"221394791022293154273777459030637463810"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"},"deprecated":false,"digest":{"line_hashes":["85564889611049434015439836351970671330","321032152181963527884525531471844641270","3432312994283051198705360490823037384","26180908986988205332850313313899922389","215467192842611058928262666195218348653","88284407523653103560900716683235967625","298661402963263501180526436452982816388","296798653215701405775789907848957976896","292903738859645515677839881079245263014"],"threshold":0.9},"id":"ASB-A-517377154-7663ce10","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103","target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java","function":"dialInternal"},"deprecated":false,"digest":{"function_hash":"201191755801169938559793686686857451416","length":931},"id":"ASB-A-517377154-92d426e8","signature_type":"Function"},{"id":"ASB-A-517377154-d5bd7508","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103","target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["277581113841276915046506624877618589123","26807683584315311557738686723874494849","180113764066743593245372552958971069287","125563055740235136696996883584854084164"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-10-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c","target":{"function":"dialInternal","file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"},"deprecated":false,"digest":{"function_hash":"6305359641223191727483443275289539815","length":822},"id":"ASB-A-517377154-5924e594","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c","target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["276486398894243870858939285016085180769","331130644673552391344038389965615968271","196359260725455957277826842540430308842","228067325901179876767365283075649691739"]},"id":"ASB-A-517377154-6daeb922","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"251213840187113905346480696010844682837","length":1304},"id":"ASB-A-517377154-7d810d39","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java","function":"dialInternal"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"},"deprecated":false,"digest":{"line_hashes":["149153288427063021861143638119183404026","100665003626303544326226369782043996662","60715967235166955707373939140397294650","336219546894114884852735354772127773921"],"threshold":0.9},"id":"ASB-A-517377154-b48d2834","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["174077472406464759824351320962334433947","325562207689985291227948377045572501240","134326709048462993827154183361924573471","304998092329951519773749479357793624221","338009389495854147057311071991689450413","110355204068176469511525399724419046930","161711783838440220482376833713856559904","90946821917742786583255147253775975404"],"threshold":0.9},"id":"ASB-A-517377154-1abd6d05","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b","target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"},"deprecated":false},{"digest":{"function_hash":"317438603624160635743171545201367024942","length":938},"id":"ASB-A-517377154-700b08c2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b","target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java","function":"dialInternal"},"deprecated":false},{"digest":{"line_hashes":["156032670633742517260113234718591625572","171455528062073778619381724172853253549","134326709048462993827154183361924573471","304998092329951519773749479357793624221","338009389495854147057311071991689450413","110355204068176469511525399724419046930","161711783838440220482376833713856559904","90946821917742786583255147253775975404"],"threshold":0.9},"id":"ASB-A-517377154-864916d6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"},"deprecated":false},{"digest":{"function_hash":"40809998033970267222727927159235444304","length":1634},"id":"ASB-A-517377154-e0919ec2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java","function":"dialInternal"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b"],"severity":"High","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["237927818888720316944931895446297837050","59836574792446009165025135316108749894","128839134679662729639640806331666225701","337071243829700196987641404901216088952"]},"id":"ASB-A-517377154-329f220f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b"},{"digest":{"function_hash":"285767272394866841301906938934138203699","length":1537},"id":"ASB-A-517377154-46ebd872","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java","function":"dialInternal"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b","target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["6481862458218090228218788075869645289","115463448771535689218673312633010310118","128839134679662729639640806331666225701","27394729640458959225443737895051313693"]},"id":"ASB-A-517377154-77e7610a"},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b","target":{"function":"dialInternal","file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"},"deprecated":false,"digest":{"function_hash":"72497289640835833960216901968607590254","length":774},"id":"ASB-A-517377154-b3f1c5a5","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"},"deprecated":false,"digest":{"line_hashes":["88284407523653103560900716683235967625","298661402963263501180526436452982816388","296798653215701405775789907848957976896","292903738859645515677839881079245263014"],"threshold":0.9},"id":"ASB-A-517377154-4a6f2b8d"},{"digest":{"function_hash":"221394791022293154273777459030637463810","length":1700},"id":"ASB-A-517377154-5fd5c6ae","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java","function":"dialInternal"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a","target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java","function":"dialInternal"},"deprecated":false,"digest":{"length":931,"function_hash":"201191755801169938559793686686857451416"},"id":"ASB-A-517377154-ad12e3f6"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["277581113841276915046506624877618589123","26807683584315311557738686723874494849","180113764066743593245372552958971069287","125563055740235136696996883584854084164"]},"id":"ASB-A-517377154-d6fda682","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a","target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-10-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java","function":"dialInternal"},"deprecated":false,"digest":{"function_hash":"251213840187113905346480696010844682837","length":1304},"id":"ASB-A-517377154-33711728"},{"target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["276486398894243870858939285016085180769","331130644673552391344038389965615968271","196359260725455957277826842540430308842","228067325901179876767365283075649691739"]},"id":"ASB-A-517377154-526af996","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de"},{"deprecated":false,"digest":{"line_hashes":["149153288427063021861143638119183404026","100665003626303544326226369782043996662","60715967235166955707373939140397294650","336219546894114884852735354772127773921"],"threshold":0.9},"id":"ASB-A-517377154-7117f3c9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de","target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"}},{"target":{"function":"dialInternal","file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"},"deprecated":false,"digest":{"function_hash":"6305359641223191727483443275289539815","length":822},"id":"ASB-A-517377154-a01b9dad","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"}}],"schema_version":"1.9.0"}