{"id":"ASB-A-527036864","details":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-527036864","CVE-2026-58944"],"modified":"2026-11-02T16:56:26.432132539Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/12d5de2a0e06beb34abce054ab0e8897135da323","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["62011701134777276986251248852539614540","92172802454453612133839956802899567819","224387390911462804685994490359867579533","330199258119220903441018735575446108565","255406588669344269331232759051632105725","36416561039801639012166314874104608982"]},"id":"ASB-A-527036864-23645a5a","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/12d5de2a0e06beb34abce054ab0e8897135da323","target":{"function":"moveTaskToFrontLocked","file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"function_hash":"20102728011151154153999897544205216947","length":1276},"id":"ASB-A-527036864-23fb83c7","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/12d5de2a0e06beb34abce054ab0e8897135da323"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036864.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2f47d65518c42eff6e4cf7b6faf7846cc37ac585"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["62011701134777276986251248852539614540","92172802454453612133839956802899567819","224387390911462804685994490359867579533","330199258119220903441018735575446108565","255406588669344269331232759051632105725","36416561039801639012166314874104608982"]},"id":"ASB-A-527036864-2aa5177b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2f47d65518c42eff6e4cf7b6faf7846cc37ac585","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2f47d65518c42eff6e4cf7b6faf7846cc37ac585","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"moveTaskToFrontLocked"},"deprecated":false,"digest":{"function_hash":"179853645378831390113868602560305857675","length":1303},"id":"ASB-A-527036864-34c753a6"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036864.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-527036864-3d1f42d1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6bffdca7b65c9dbbb4fdd227a5d260a8a10282f7","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"moveTaskToFrontLocked"},"deprecated":false,"digest":{"function_hash":"20102728011151154153999897544205216947","length":1276}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6bffdca7b65c9dbbb4fdd227a5d260a8a10282f7","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"line_hashes":["62011701134777276986251248852539614540","92172802454453612133839956802899567819","224387390911462804685994490359867579533","330199258119220903441018735575446108565","255406588669344269331232759051632105725","36416561039801639012166314874104608982"],"threshold":0.9},"id":"ASB-A-527036864-d405e3e2"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6bffdca7b65c9dbbb4fdd227a5d260a8a10282f7"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036864.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"line_hashes":["62011701134777276986251248852539614540","92172802454453612133839956802899567819","224387390911462804685994490359867579533","330199258119220903441018735575446108565","255406588669344269331232759051632105725","36416561039801639012166314874104608982"],"threshold":0.9},"id":"ASB-A-527036864-36c38ec9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bf8dfb689b691fd9f45eee45bb2acbe18bf51df9"},{"target":{"function":"moveTaskToFrontLocked","file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"length":1276,"function_hash":"20102728011151154153999897544205216947"},"id":"ASB-A-527036864-93dea2fe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bf8dfb689b691fd9f45eee45bb2acbe18bf51df9"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bf8dfb689b691fd9f45eee45bb2acbe18bf51df9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036864.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bcc3623a3517c6ca2dd394dd787a03f443b48922"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-527036864-a3b68181","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bcc3623a3517c6ca2dd394dd787a03f443b48922","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"line_hashes":["62011701134777276986251248852539614540","92172802454453612133839956802899567819","224387390911462804685994490359867579533","330199258119220903441018735575446108565","255406588669344269331232759051632105725","36416561039801639012166314874104608982"],"threshold":0.9}},{"target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"moveTaskToFrontLocked"},"deprecated":false,"digest":{"function_hash":"20102728011151154153999897544205216947","length":1276},"id":"ASB-A-527036864-caabe1b0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bcc3623a3517c6ca2dd394dd787a03f443b48922"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036864.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/830197729015ed2fbac1cd2b632ec955266625f2"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["62011701134777276986251248852539614540","92172802454453612133839956802899567819","224387390911462804685994490359867579533","330199258119220903441018735575446108565","255406588669344269331232759051632105725","36416561039801639012166314874104608982"]},"id":"ASB-A-527036864-059e7692","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/830197729015ed2fbac1cd2b632ec955266625f2"},{"digest":{"function_hash":"42346744992559043575359746376775918518","length":1105},"id":"ASB-A-527036864-d7662a7b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/830197729015ed2fbac1cd2b632ec955266625f2","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"moveTaskToFrontLocked"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527036864.json"}}],"schema_version":"1.9.2"}