{"id":"ASB-A-527036176","details":"In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-527036176","CVE-2026-58974"],"modified":"2026-11-02T17:11:15.934176568Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":1409,"function_hash":"254756202945044017983340208008594186703"},"id":"ASB-A-527036176-27c89c04","match_only_versions":["17-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f","target":{"file":"core/java/android/os/Binder.java","function":"onShellCommand"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["200150622722840859512874629774355797161","334312262691176547190964272951743523005","326635729397598627440176343103780594072","7789538731787653007042207216705328657"]},"id":"ASB-A-527036176-464a19db","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-527036176-5c479331","match_only_versions":["17-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f","target":{"file":"core/java/android/os/Binder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["224412128432702335873494000300338225386","317252062471637607374019347752961870835","181573889494107209853229754953908744053","302033350515499424860335407153973995592","215187824298931299292553244399989910044","188242131689888584309477795810181248455","155519689672058273751795971522394075396","153165129434553141139131647291026347801","242128928378382133731892180874546068540","181321619002047399963138584572953430843","110530567039366567086632157752472759501"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f","target":{"function":"onShellCommand","file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"length":196,"function_hash":"266863510474315262488227988797878654698"},"id":"ASB-A-527036176-61ae4709"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"onShellCommand"},"deprecated":false,"digest":{"function_hash":"266863510474315262488227988797878654698","length":196},"id":"ASB-A-527036176-26e4c269","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60","target":{"file":"core/java/android/os/Binder.java","function":"onShellCommand"},"deprecated":false,"digest":{"function_hash":"254756202945044017983340208008594186703","length":1409},"id":"ASB-A-527036176-6713c2cc","match_only_versions":["15"]},{"source":"https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"line_hashes":["200150622722840859512874629774355797161","334312262691176547190964272951743523005","326635729397598627440176343103780594072","32126585500871840016330705785166556816"],"threshold":0.9},"id":"ASB-A-527036176-c2dc9ca1","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-527036176-cc59bd00","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60","target":{"file":"core/java/android/os/Binder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["78679364347369504733144188217313619822","196170694888987423643355606095205774638","181478182630068703693810259999230260630","302033350515499424860335407153973995592","215187824298931299292553244399989910044","188242131689888584309477795810181248455","155519689672058273751795971522394075396","153165129434553141139131647291026347801","242128928378382133731892180874546068540","181321619002047399963138584572953430843","110530567039366567086632157752472759501"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-527036176-2226c5fc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["200150622722840859512874629774355797161","334312262691176547190964272951743523005","326635729397598627440176343103780594072","7789538731787653007042207216705328657"]}},{"id":"ASB-A-527036176-c27447b8","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d","target":{"function":"onShellCommand","file":"core/java/android/os/Binder.java"},"deprecated":false,"digest":{"length":1409,"function_hash":"254756202945044017983340208008594186703"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d","target":{"file":"core/java/android/os/Binder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["78679364347369504733144188217313619822","196170694888987423643355606095205774638","181478182630068703693810259999230260630","302033350515499424860335407153973995592","215187824298931299292553244399989910044","188242131689888584309477795810181248455","155519689672058273751795971522394075396","153165129434553141139131647291026347801","242128928378382133731892180874546068540","181321619002047399963138584572953430843","110530567039366567086632157752472759501"]},"id":"ASB-A-527036176-ca0c8f6a","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"onShellCommand"},"deprecated":false,"digest":{"function_hash":"266863510474315262488227988797878654698","length":196},"id":"ASB-A-527036176-f5c6d681","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-527036176-0bbaeec5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8","target":{"function":"onShellCommand","file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"length":196,"function_hash":"266863510474315262488227988797878654698"}},{"target":{"file":"core/java/android/os/Binder.java"},"deprecated":false,"digest":{"line_hashes":["78679364347369504733144188217313619822","196170694888987423643355606095205774638","181478182630068703693810259999230260630","302033350515499424860335407153973995592","215187824298931299292553244399989910044","188242131689888584309477795810181248455","155519689672058273751795971522394075396","153165129434553141139131647291026347801","242128928378382133731892180874546068540","181321619002047399963138584572953430843","110530567039366567086632157752472759501"],"threshold":0.9},"id":"ASB-A-527036176-1f49cd47","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"line_hashes":["200150622722840859512874629774355797161","334312262691176547190964272951743523005","326635729397598627440176343103780594072","7789538731787653007042207216705328657"],"threshold":0.9},"id":"ASB-A-527036176-7c48c74c"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8","target":{"file":"core/java/android/os/Binder.java","function":"onShellCommand"},"deprecated":false,"digest":{"function_hash":"254756202945044017983340208008594186703","length":1409},"id":"ASB-A-527036176-bf3bb7c1","match_only_versions":["16-qpr2"],"signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1","target":{"file":"core/java/android/os/Binder.java"},"deprecated":false,"digest":{"line_hashes":["78679364347369504733144188217313619822","196170694888987423643355606095205774638","181478182630068703693810259999230260630","302033350515499424860335407153973995592","215187824298931299292553244399989910044","188242131689888584309477795810181248455","155519689672058273751795971522394075396","153165129434553141139131647291026347801","242128928378382133731892180874546068540","181321619002047399963138584572953430843","110530567039366567086632157752472759501"],"threshold":0.9},"id":"ASB-A-527036176-0f9f100a","signature_type":"Line"},{"target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"line_hashes":["200150622722840859512874629774355797161","334312262691176547190964272951743523005","326635729397598627440176343103780594072","7789538731787653007042207216705328657"],"threshold":0.9},"id":"ASB-A-527036176-263df9a6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1"},{"match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1","target":{"file":"core/java/android/os/Binder.java","function":"onShellCommand"},"deprecated":false,"digest":{"function_hash":"254756202945044017983340208008594186703","length":1409},"id":"ASB-A-527036176-a05eca5c"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"onShellCommand"},"deprecated":false,"digest":{"function_hash":"266863510474315262488227988797878654698","length":196},"id":"ASB-A-527036176-d30c7f47"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":196,"function_hash":"266863510474315262488227988797878654698"},"id":"ASB-A-527036176-47a3bf94","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"onShellCommand"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["78679364347369504733144188217313619822","196170694888987423643355606095205774638","181478182630068703693810259999230260630","302033350515499424860335407153973995592","215187824298931299292553244399989910044","188242131689888584309477795810181248455","155519689672058273751795971522394075396","153165129434553141139131647291026347801","242128928378382133731892180874546068540","181321619002047399963138584572953430843","110530567039366567086632157752472759501"]},"id":"ASB-A-527036176-77635436","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417","target":{"file":"core/java/android/os/Binder.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417","target":{"function":"onShellCommand","file":"core/java/android/os/Binder.java"},"deprecated":false,"digest":{"function_hash":"254756202945044017983340208008594186703","length":1409},"id":"ASB-A-527036176-8ef6ee3a","match_only_versions":["14"],"signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["200150622722840859512874629774355797161","334312262691176547190964272951743523005","326635729397598627440176343103780594072","32126585500871840016330705785166556816"]},"id":"ASB-A-527036176-c9d526a4"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036176.json"}}],"schema_version":"1.9.2"}