{"id":"PUB-A-201535148","details":"In gallery3d and photos, there is a possible permission bypass  due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-201535148","CVE-2022-20196"],"modified":"2026-05-27T15:53:17.428190120Z","published":"2022-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-06-01"}],"affected":[{"package":{"name":"platform/packages/apps/Gallery2","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L-next:0"},{"fixed":"12L-next:2022-06-01"}]}],"versions":["12L-next"],"ecosystem_specific":{"severity":"Moderate","fixes":["https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"],"vanir_signatures":[{"signature_version":"v1","target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"updateActionItemVisibilities"},"signature_type":"Function","digest":{"function_hash":"179681300963211884690056854096109177439","length":883},"id":"PUB-A-201535148-0408e7fe","deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/photos/SelectionManager.java","function":"getSupportedOperations"},"signature_type":"Function","id":"PUB-A-201535148-07af6257","digest":{"function_hash":"184387040173152115022342393261607881443","length":683},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"singleItemAction"},"signature_type":"Function","id":"PUB-A-201535148-2b1036c0","digest":{"function_hash":"335011826790043392630544543866283663031","length":1097},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java","function":"onMenuClicked"},"signature_type":"Function","id":"PUB-A-201535148-3713441c","digest":{"function_hash":"41913397070175780202437061129792075600","length":1306},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_type":"Line","target":{"file":"src/com/android/gallery3d/filtershow/crop/CropExtras.java"},"signature_version":"v1","id":"PUB-A-201535148-3cdf8772","digest":{"threshold":0.9,"line_hashes":["272018259021943783205849101147608568733","137581051104587709188855779283222203108","338794538615841014784270552832882576755","80863795701381455483949491168699941711"]},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/filtershow/crop/CropExtras.java","function":"getSetAsWallpaper"},"signature_type":"Function","id":"PUB-A-201535148-5238fabc","digest":{"function_hash":"326614150324117000539187597533491653795","length":47},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java","function":"updateMenuOperation"},"signature_type":"Function","id":"PUB-A-201535148-5c9ed1fc","digest":{"function_hash":"296747417119701921630196183976897207130","length":1476},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"onActionItemClicked"},"signature_type":"Function","id":"PUB-A-201535148-9ea0b634","digest":{"function_hash":"88770189073130505689489628266389993757","length":502},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/app/Wallpaper.java","function":"onResume"},"signature_type":"Function","id":"PUB-A-201535148-a5b34fc4","digest":{"function_hash":"31529863024041711136088590505432417332","length":1539},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/photos/MultiChoiceManager.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["287763971711858840098279022214630876988","187988274275283550147830497290301420441","201522223309010860651893908295667489615","121954893617204765319326971000648226862","249640372737757808846403484065354954821","183769391861600464599496911412101346122","262036402309424011414910616115479701656","256683422540964159539606735054655957184","243957678430995573566925527953747398962","148286491930507001382827749632563190930","3606904002022886931448748019589180581","269469012310099494097450128701817986919","31164928444746970187876121022249206657","296375168345528532492996563526397360584","43080184678014704929720041943995998925","313914771089130725522197459165058449628","109959396567554365597966938030984504897","229518798119626208676306537033084975504","40834759440703385597187735909600018446","241725881171290840478619643200614649750","292461756493065011169907122949177552354","248506109080575602118150501373756955912","214121499551973233281404391975184302607"]},"id":"PUB-A-201535148-baac45bd","deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_type":"Function","target":{"file":"src/com/android/gallery3d/app/PhotoPage.java","function":"onItemSelected"},"signature_version":"v1","id":"PUB-A-201535148-cabceaf2","digest":{"function_hash":"66694820858705258142543906607286954067","length":2387},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/app/Wallpaper.java"},"signature_type":"Line","id":"PUB-A-201535148-d0b06bfa","digest":{"threshold":0.9,"line_hashes":["233679669455163180458030757234993939373","70056024488384320867007010422669630648","243746658011635173107285039142075651991","238244001096546311531779717624087118393"]},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/photos/SelectionManager.java"},"signature_type":"Line","id":"PUB-A-201535148-d286dad9","digest":{"threshold":0.9,"line_hashes":["208673660295514683132692648017397944953","24713391475014316976081674721436852615","219965225015347593613601824453551054076","130482664255764128077107670642087959200","219554274769602169267509696708206331840","292930793279240040612263451674494107236","220466905632410632604949305232363880686","36674523091403191071595003439103495433","43418378897529182851012265393080377056","213097997382651313558684976144026383149","251182660361597744502577074312175136311","93090113854154495696553465909703588788"]},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java"},"signature_type":"Line","id":"PUB-A-201535148-d9b2366b","digest":{"threshold":0.9,"line_hashes":["279284354312107074129456476700958771317","16501995534669389089472062382269442370","194345204458721792808215576498277161544","247732857133338579513760730270025858434","11980613438868346606334324488621405166","64990868813736873776463816795653820102","223058199112326144169930372802264350807","260832227887862968083595589139864507451","178721538254165060881116959579052624134","169198294328947212607600825826149835216","268528517353140598909951205710051127885","236777254992167792333903165531972326835","318893575094053491345868569448706827410","302252561123043977982669401659564012299","133631319513995126936760864433233787585","311032956931086933920416908866448764390","40237509832839309742732852226651313165","283232841551118526899684000439227304286","75675672912105331042870912728446487883","220898095745319484895200771805050271496"]},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/app/PhotoPage.java"},"signature_type":"Line","id":"PUB-A-201535148-df942440","digest":{"threshold":0.9,"line_hashes":["124121812550960019558153676448282905593","304360074345030846887980361974022487906","130498359058527096788693341429213991671","293444533696919588124636516215613772621"]},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"},{"signature_version":"v1","target":{"file":"src/com/android/photos/SelectionManager.java","function":"onItemSelectedStateChanged"},"signature_type":"Function","id":"PUB-A-201535148-f6df10b5","digest":{"function_hash":"68048970771639542270417442158916044187","length":2020},"deprecated":false,"match_only_versions":["12L-next"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/35ab9cd99173079886c3cd636b0606f55fefd846"}],"spl":"2022-06-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-201535148.json"}},{"package":{"name":"platform/packages/apps/Gallery2","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-06-01"}]}],"versions":["12L"],"ecosystem_specific":{"severity":"Moderate","fixes":["https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"],"vanir_signatures":[{"signature_version":"v1","target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"onActionItemClicked"},"signature_type":"Function","digest":{"function_hash":"88770189073130505689489628266389993757","length":502},"id":"PUB-A-201535148-074bb6e0","deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java"},"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["279284354312107074129456476700958771317","16501995534669389089472062382269442370","194345204458721792808215576498277161544","247732857133338579513760730270025858434","11980613438868346606334324488621405166","64990868813736873776463816795653820102","223058199112326144169930372802264350807","260832227887862968083595589139864507451","178721538254165060881116959579052624134","169198294328947212607600825826149835216","268528517353140598909951205710051127885","236777254992167792333903165531972326835","318893575094053491345868569448706827410","302252561123043977982669401659564012299","133631319513995126936760864433233787585","311032956931086933920416908866448764390","40237509832839309742732852226651313165","283232841551118526899684000439227304286","75675672912105331042870912728446487883","220898095745319484895200771805050271496"]},"id":"PUB-A-201535148-1830fa04","deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_type":"Function","target":{"file":"src/com/android/photos/SelectionManager.java","function":"onItemSelectedStateChanged"},"signature_version":"v1","id":"PUB-A-201535148-1aa19f18","digest":{"function_hash":"68048970771639542270417442158916044187","length":2020},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/photos/MultiChoiceManager.java"},"signature_type":"Line","id":"PUB-A-201535148-2032651f","digest":{"threshold":0.9,"line_hashes":["287763971711858840098279022214630876988","187988274275283550147830497290301420441","201522223309010860651893908295667489615","121954893617204765319326971000648226862","249640372737757808846403484065354954821","183769391861600464599496911412101346122","262036402309424011414910616115479701656","256683422540964159539606735054655957184","243957678430995573566925527953747398962","148286491930507001382827749632563190930","3606904002022886931448748019589180581","269469012310099494097450128701817986919","31164928444746970187876121022249206657","296375168345528532492996563526397360584","43080184678014704929720041943995998925","313914771089130725522197459165058449628","109959396567554365597966938030984504897","229518798119626208676306537033084975504","40834759440703385597187735909600018446","241725881171290840478619643200614649750","292461756493065011169907122949177552354","248506109080575602118150501373756955912","214121499551973233281404391975184302607"]},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/app/Wallpaper.java"},"signature_type":"Line","id":"PUB-A-201535148-3091f466","digest":{"threshold":0.9,"line_hashes":["233679669455163180458030757234993939373","70056024488384320867007010422669630648","243746658011635173107285039142075651991","238244001096546311531779717624087118393"]},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/filtershow/crop/CropExtras.java"},"signature_type":"Line","id":"PUB-A-201535148-4b141a98","digest":{"threshold":0.9,"line_hashes":["272018259021943783205849101147608568733","137581051104587709188855779283222203108","338794538615841014784270552832882576755","80863795701381455483949491168699941711"]},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java","function":"onMenuClicked"},"signature_type":"Function","id":"PUB-A-201535148-6bd2bd8c","digest":{"function_hash":"41913397070175780202437061129792075600","length":1306},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"singleItemAction"},"signature_type":"Function","id":"PUB-A-201535148-74265526","digest":{"function_hash":"335011826790043392630544543866283663031","length":1097},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_type":"Function","target":{"file":"src/com/android/gallery3d/ui/MenuExecutor.java","function":"updateMenuOperation"},"signature_version":"v1","id":"PUB-A-201535148-8d3e94d8","digest":{"function_hash":"296747417119701921630196183976897207130","length":1476},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/app/PhotoPage.java"},"signature_type":"Line","id":"PUB-A-201535148-91897955","digest":{"threshold":0.9,"line_hashes":["124121812550960019558153676448282905593","304360074345030846887980361974022487906","130498359058527096788693341429213991671","293444533696919588124636516215613772621"]},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/photos/SelectionManager.java"},"signature_type":"Line","id":"PUB-A-201535148-982bfcc7","digest":{"threshold":0.9,"line_hashes":["208673660295514683132692648017397944953","24713391475014316976081674721436852615","219965225015347593613601824453551054076","130482664255764128077107670642087959200","219554274769602169267509696708206331840","292930793279240040612263451674494107236","220466905632410632604949305232363880686","36674523091403191071595003439103495433","43418378897529182851012265393080377056","213097997382651313558684976144026383149","251182660361597744502577074312175136311","93090113854154495696553465909703588788"]},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/photos/MultiChoiceManager.java","function":"updateActionItemVisibilities"},"signature_type":"Function","id":"PUB-A-201535148-bdb90633","digest":{"function_hash":"179681300963211884690056854096109177439","length":883},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_type":"Function","target":{"file":"src/com/android/gallery3d/app/Wallpaper.java","function":"onResume"},"signature_version":"v1","id":"PUB-A-201535148-da218cc5","digest":{"function_hash":"31529863024041711136088590505432417332","length":1539},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/photos/SelectionManager.java","function":"getSupportedOperations"},"signature_type":"Function","id":"PUB-A-201535148-f4822b42","digest":{"function_hash":"184387040173152115022342393261607881443","length":683},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/filtershow/crop/CropExtras.java","function":"getSetAsWallpaper"},"signature_type":"Function","id":"PUB-A-201535148-f685ae1e","digest":{"function_hash":"326614150324117000539187597533491653795","length":47},"deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"},{"signature_version":"v1","target":{"file":"src/com/android/gallery3d/app/PhotoPage.java","function":"onItemSelected"},"signature_type":"Function","digest":{"function_hash":"66694820858705258142543906607286954067","length":2387},"id":"PUB-A-201535148-f94382a5","deprecated":false,"match_only_versions":["12L"],"source":"https://android.googlesource.com/platform/packages/apps/Gallery2/+/0bd4d095a726eb491c51aaa2d66021786c1d331a"}],"spl":"2022-06-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-201535148.json"}}],"schema_version":"1.7.5"}