{"id":"ASB-A-154719656", "published":"2020-08-01T00:00:00Z", "modified":"2026-06-05T15:03:38.651710474Z", "aliases":["CVE-2020-0249", "A-154719656"], "details":"In postInstantAppNotif of InstantAppNotifier.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"8.0:0"}, {"fixed":"8.0:2020-08-01"}]}], "versions":["8.0"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049"], "severity":"High", "spl":"2020-08-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["84758114983735900551548978800556125012", "93756632676279850995999905901852099997", "194328561703662452990324946098911064382", "700702891297064350554210703065303117", "258463728252934941378273867618062066218", "196587567970045056011580876192637823744", "269197074124735184946793168679993474387", "57626723174612515715514647392257974996", "305106949828049998484046415736075577248", "157110966944728195262182290015732726786", "232134632623764012886555121518380438118", "178520272349305907350673817014587359550", "7951077464780825892700418966880600902"], "threshold":0.9}, "id":"ASB-A-154719656-71ff3186", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049", "target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/InstantAppNotifier.java"}}, {"deprecated":false, "digest":{"function_hash":"158391304709434895751910842623360938627", "length":2818}, "id":"ASB-A-154719656-e740fc4d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049", "target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/InstantAppNotifier.java", "function":"postInstantAppNotif"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"8.1:0"}, {"fixed":"8.1:2020-08-01"}]}], "versions":["8.1"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049"], "severity":"High", "spl":"2020-08-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["84758114983735900551548978800556125012", "93756632676279850995999905901852099997", "194328561703662452990324946098911064382", "700702891297064350554210703065303117", "258463728252934941378273867618062066218", "196587567970045056011580876192637823744", "269197074124735184946793168679993474387", "57626723174612515715514647392257974996", "305106949828049998484046415736075577248", "157110966944728195262182290015732726786", "232134632623764012886555121518380438118", "178520272349305907350673817014587359550", "7951077464780825892700418966880600902"], "threshold":0.9}, "id":"ASB-A-154719656-83dcc69e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049", "target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/InstantAppNotifier.java"}}, {"deprecated":false, "digest":{"function_hash":"158391304709434895751910842623360938627", "length":2818}, "id":"ASB-A-154719656-c0c405eb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049", "target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/InstantAppNotifier.java", "function":"postInstantAppNotif"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"9:0"}, {"fixed":"9:2020-08-01"}]}], "versions":["9"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049"], "severity":"High", "spl":"2020-08-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"158391304709434895751910842623360938627", "length":2818}, "id":"ASB-A-154719656-7ec5038b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049", "target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/InstantAppNotifier.java", "function":"postInstantAppNotif"}}, {"deprecated":false, "digest":{"line_hashes":["84758114983735900551548978800556125012", "93756632676279850995999905901852099997", "194328561703662452990324946098911064382", "700702891297064350554210703065303117", "258463728252934941378273867618062066218", "196587567970045056011580876192637823744", "269197074124735184946793168679993474387", "57626723174612515715514647392257974996", "305106949828049998484046415736075577248", "157110966944728195262182290015732726786", "232134632623764012886555121518380438118", "178520272349305907350673817014587359550", "7951077464780825892700418966880600902"], "threshold":0.9}, "id":"ASB-A-154719656-85eea097", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049", "target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/InstantAppNotifier.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"10:0"}, {"fixed":"10:2020-08-01"}]}], "versions":["10"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049"], "severity":"High", "spl":"2020-08-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["84758114983735900551548978800556125012", "93756632676279850995999905901852099997", "194328561703662452990324946098911064382", "700702891297064350554210703065303117", "258463728252934941378273867618062066218", "196587567970045056011580876192637823744", "269197074124735184946793168679993474387", "57626723174612515715514647392257974996", "305106949828049998484046415736075577248", "157110966944728195262182290015732726786", "232134632623764012886555121518380438118", "178520272349305907350673817014587359550", "7951077464780825892700418966880600902"], "threshold":0.9}, "id":"ASB-A-154719656-2ccf7e53", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049", "target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/InstantAppNotifier.java"}}, {"deprecated":false, "digest":{"function_hash":"158391304709434895751910842623360938627", "length":2818}, "id":"ASB-A-154719656-89005652", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049", "target":{"file":"packages/SystemUI/src/com/android/systemui/statusbar/notification/InstantAppNotifier.java", "function":"postInstantAppNotif"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2020-08-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/e183ab7e5a865ff1051505085b617f4f3ad4c049"}]}