{"id":"PUB-A-201535148","details":"In gallery3d and photos, there is a possible permission bypass  due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-201535148","CVE-2022-20196"],"modified":"2026-05-22T15:55:21.353668239Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"}],"affected":[{"package":{"name":"platform/packages/apps/Gallery2","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L-next:0"},{"fixed":"12L-next:2022-06-01"}]}],"versions":["12L-next"],"ecosystem_specific":{"severity":"Moderate","fixes":["https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"],"vanir_signatures":[{"target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"updateActionItemVisibilities"},"digest":{"length":883,"function_hash":"179681300963211884690056854096109177439"},"signature_type":"Function","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-0408e7fe","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/photos/SelectionManager.java","function":"getSupportedOperations"},"digest":{"length":683,"function_hash":"184387040173152115022342393261607881443"},"signature_type":"Function","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-07af6257","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"singleItemAction"},"digest":{"length":1097,"function_hash":"335011826790043392630544543866283663031"},"signature_type":"Function","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-2b1036c0","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java","function":"onMenuClicked"},"digest":{"length":1306,"function_hash":"41913397070175780202437061129792075600"},"signature_type":"Function","match_only_versions":["12L-next"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846","id":"PUB-A-201535148-3713441c"},{"target":{"file":"src/com/android/gallery3d/filtershow/crop/CropExtras.java"},"digest":{"threshold":0.9,"line_hashes":["272018259021943783205849101147608568733","137581051104587709188855779283222203108","338794538615841014784270552832882576755","80863795701381455483949491168699941711"]},"signature_type":"Line","match_only_versions":["12L-next"],"signature_version":"v1","deprecated":false,"id":"PUB-A-201535148-3cdf8772","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/gallery3d/filtershow/crop/CropExtras.java","function":"getSetAsWallpaper"},"digest":{"length":47,"function_hash":"326614150324117000539187597533491653795"},"signature_type":"Function","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-5238fabc","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java","function":"updateMenuOperation"},"digest":{"length":1476,"function_hash":"296747417119701921630196183976897207130"},"signature_type":"Function","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-5c9ed1fc","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"onActionItemClicked"},"digest":{"length":502,"function_hash":"88770189073130505689489628266389993757"},"signature_type":"Function","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846","id":"PUB-A-201535148-9ea0b634"},{"target":{"file":"src/com/android/gallery3d/app/Wallpaper.java","function":"onResume"},"digest":{"length":1539,"function_hash":"31529863024041711136088590505432417332"},"signature_type":"Function","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-a5b34fc4","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/photos/MultiChoiceManager.java"},"digest":{"threshold":0.9,"line_hashes":["287763971711858840098279022214630876988","187988274275283550147830497290301420441","201522223309010860651893908295667489615","121954893617204765319326971000648226862","249640372737757808846403484065354954821","183769391861600464599496911412101346122","262036402309424011414910616115479701656","256683422540964159539606735054655957184","243957678430995573566925527953747398962","148286491930507001382827749632563190930","3606904002022886931448748019589180581","269469012310099494097450128701817986919","31164928444746970187876121022249206657","296375168345528532492996563526397360584","43080184678014704929720041943995998925","313914771089130725522197459165058449628","109959396567554365597966938030984504897","229518798119626208676306537033084975504","40834759440703385597187735909600018446","241725881171290840478619643200614649750","292461756493065011169907122949177552354","248506109080575602118150501373756955912","214121499551973233281404391975184302607"]},"signature_type":"Line","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846","id":"PUB-A-201535148-baac45bd"},{"target":{"file":"src/com/android/gallery3d/app/PhotoPage.java","function":"onItemSelected"},"digest":{"length":2387,"function_hash":"66694820858705258142543906607286954067"},"signature_type":"Function","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-cabceaf2","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/gallery3d/app/Wallpaper.java"},"digest":{"threshold":0.9,"line_hashes":["233679669455163180458030757234993939373","70056024488384320867007010422669630648","243746658011635173107285039142075651991","238244001096546311531779717624087118393"]},"signature_type":"Line","match_only_versions":["12L-next"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846","id":"PUB-A-201535148-d0b06bfa"},{"target":{"file":"src/com/android/photos/SelectionManager.java"},"digest":{"threshold":0.9,"line_hashes":["208673660295514683132692648017397944953","24713391475014316976081674721436852615","219965225015347593613601824453551054076","130482664255764128077107670642087959200","219554274769602169267509696708206331840","292930793279240040612263451674494107236","220466905632410632604949305232363880686","36674523091403191071595003439103495433","43418378897529182851012265393080377056","213097997382651313558684976144026383149","251182660361597744502577074312175136311","93090113854154495696553465909703588788"]},"signature_type":"Line","match_only_versions":["12L-next"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-d286dad9","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java"},"digest":{"threshold":0.9,"line_hashes":["279284354312107074129456476700958771317","16501995534669389089472062382269442370","194345204458721792808215576498277161544","247732857133338579513760730270025858434","11980613438868346606334324488621405166","64990868813736873776463816795653820102","223058199112326144169930372802264350807","260832227887862968083595589139864507451","178721538254165060881116959579052624134","169198294328947212607600825826149835216","268528517353140598909951205710051127885","236777254992167792333903165531972326835","318893575094053491345868569448706827410","302252561123043977982669401659564012299","133631319513995126936760864433233787585","311032956931086933920416908866448764390","40237509832839309742732852226651313165","283232841551118526899684000439227304286","75675672912105331042870912728446487883","220898095745319484895200771805050271496"]},"signature_type":"Line","match_only_versions":["12L-next"],"signature_version":"v1","deprecated":false,"id":"PUB-A-201535148-d9b2366b","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"target":{"file":"src/com/android/gallery3d/app/PhotoPage.java"},"digest":{"threshold":0.9,"line_hashes":["124121812550960019558153676448282905593","304360074345030846887980361974022487906","130498359058527096788693341429213991671","293444533696919588124636516215613772621"]},"signature_type":"Line","match_only_versions":["12L-next"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846","id":"PUB-A-201535148-df942440"},{"target":{"file":"src/com/android/photos/SelectionManager.java","function":"onItemSelectedStateChanged"},"digest":{"length":2020,"function_hash":"68048970771639542270417442158916044187"},"signature_type":"Function","match_only_versions":["12L-next"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846","id":"PUB-A-201535148-f6df10b5"}],"types":["ID"],"spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-201535148.json"}},{"package":{"name":"platform/packages/apps/Gallery2","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"onActionItemClicked"},"digest":{"length":502,"function_hash":"88770189073130505689489628266389993757"},"signature_type":"Function","match_only_versions":["12L"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-074bb6e0","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java"},"digest":{"threshold":0.9,"line_hashes":["279284354312107074129456476700958771317","16501995534669389089472062382269442370","194345204458721792808215576498277161544","247732857133338579513760730270025858434","11980613438868346606334324488621405166","64990868813736873776463816795653820102","223058199112326144169930372802264350807","260832227887862968083595589139864507451","178721538254165060881116959579052624134","169198294328947212607600825826149835216","268528517353140598909951205710051127885","236777254992167792333903165531972326835","318893575094053491345868569448706827410","302252561123043977982669401659564012299","133631319513995126936760864433233787585","311032956931086933920416908866448764390","40237509832839309742732852226651313165","283232841551118526899684000439227304286","75675672912105331042870912728446487883","220898095745319484895200771805050271496"]},"signature_type":"Line","match_only_versions":["12L"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-1830fa04","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"target":{"file":"src/com/android/photos/SelectionManager.java","function":"onItemSelectedStateChanged"},"digest":{"length":2020,"function_hash":"68048970771639542270417442158916044187"},"signature_type":"Function","match_only_versions":["12L"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a","id":"PUB-A-201535148-1aa19f18"},{"target":{"file":"src/com/android/photos/MultiChoiceManager.java"},"digest":{"threshold":0.9,"line_hashes":["287763971711858840098279022214630876988","187988274275283550147830497290301420441","201522223309010860651893908295667489615","121954893617204765319326971000648226862","249640372737757808846403484065354954821","183769391861600464599496911412101346122","262036402309424011414910616115479701656","256683422540964159539606735054655957184","243957678430995573566925527953747398962","148286491930507001382827749632563190930","3606904002022886931448748019589180581","269469012310099494097450128701817986919","31164928444746970187876121022249206657","296375168345528532492996563526397360584","43080184678014704929720041943995998925","313914771089130725522197459165058449628","109959396567554365597966938030984504897","229518798119626208676306537033084975504","40834759440703385597187735909600018446","241725881171290840478619643200614649750","292461756493065011169907122949177552354","248506109080575602118150501373756955912","214121499551973233281404391975184302607"]},"signature_type":"Line","match_only_versions":["12L"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a","id":"PUB-A-201535148-2032651f"},{"target":{"file":"src/com/android/gallery3d/app/Wallpaper.java"},"digest":{"threshold":0.9,"line_hashes":["233679669455163180458030757234993939373","70056024488384320867007010422669630648","243746658011635173107285039142075651991","238244001096546311531779717624087118393"]},"signature_type":"Line","match_only_versions":["12L"],"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a","id":"PUB-A-201535148-3091f466"},{"target":{"file":"src/com/android/gallery3d/filtershow/crop/CropExtras.java"},"digest":{"threshold":0.9,"line_hashes":["272018259021943783205849101147608568733","137581051104587709188855779283222203108","338794538615841014784270552832882576755","80863795701381455483949491168699941711"]},"signature_type":"Line","match_only_versions":["12L"],"signature_version":"v1","deprecated":false,"id":"PUB-A-201535148-4b141a98","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java","function":"onMenuClicked"},"digest":{"length":1306,"function_hash":"41913397070175780202437061129792075600"},"signature_type":"Function","match_only_versions":["12L"],"signature_version":"v1","deprecated":false,"id":"PUB-A-201535148-6bd2bd8c","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"singleItemAction"},"digest":{"length":1097,"function_hash":"335011826790043392630544543866283663031"},"signature_type":"Function","match_only_versions":["12L"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a","id":"PUB-A-201535148-74265526"},{"target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java","function":"updateMenuOperation"},"digest":{"length":1476,"function_hash":"296747417119701921630196183976897207130"},"signature_type":"Function","match_only_versions":["12L"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a","id":"PUB-A-201535148-8d3e94d8"},{"target":{"file":"src/com/android/gallery3d/app/PhotoPage.java"},"digest":{"threshold":0.9,"line_hashes":["124121812550960019558153676448282905593","304360074345030846887980361974022487906","130498359058527096788693341429213991671","293444533696919588124636516215613772621"]},"signature_type":"Line","match_only_versions":["12L"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a","id":"PUB-A-201535148-91897955"},{"target":{"file":"src/com/android/photos/SelectionManager.java"},"digest":{"threshold":0.9,"line_hashes":["208673660295514683132692648017397944953","24713391475014316976081674721436852615","219965225015347593613601824453551054076","130482664255764128077107670642087959200","219554274769602169267509696708206331840","292930793279240040612263451674494107236","220466905632410632604949305232363880686","36674523091403191071595003439103495433","43418378897529182851012265393080377056","213097997382651313558684976144026383149","251182660361597744502577074312175136311","93090113854154495696553465909703588788"]},"signature_type":"Line","match_only_versions":["12L"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-982bfcc7","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"updateActionItemVisibilities"},"digest":{"length":883,"function_hash":"179681300963211884690056854096109177439"},"signature_type":"Function","match_only_versions":["12L"],"deprecated":false,"signature_version":"v1","id":"PUB-A-201535148-bdb90633","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"target":{"file":"src/com/android/gallery3d/app/Wallpaper.java","function":"onResume"},"digest":{"length":1539,"function_hash":"31529863024041711136088590505432417332"},"signature_type":"Function","match_only_versions":["12L"],"signature_version":"v1","deprecated":false,"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a","id":"PUB-A-201535148-da218cc5"},{"target":{"file":"src/com/android/photos/SelectionManager.java","function":"getSupportedOperations"},"digest":{"length":683,"function_hash":"184387040173152115022342393261607881443"},"signature_type":"Function","match_only_versions":["12L"],"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a","id":"PUB-A-201535148-f4822b42"},{"target":{"file":"src/com/android/gallery3d/filtershow/crop/CropExtras.java","function":"getSetAsWallpaper"},"digest":{"length":47,"function_hash":"326614150324117000539187597533491653795"},"signature_type":"Function","match_only_versions":["12L"],"deprecated":false,"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a","id":"PUB-A-201535148-f685ae1e"},{"target":{"file":"src/com/android/gallery3d/app/PhotoPage.java","function":"onItemSelected"},"digest":{"length":2387,"function_hash":"66694820858705258142543906607286954067"},"signature_type":"Function","match_only_versions":["12L"],"signature_version":"v1","deprecated":false,"id":"PUB-A-201535148-f94382a5","source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"}],"severity":"Moderate","fixes":["https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"],"types":["ID"],"spl":"2022-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-201535148.json"}}],"schema_version":"1.7.5"}