{"id":"ASB-A-262884935", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-28597", "A-262884935"], "details":"In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298", "https://android.googlesource.com/platform/frameworks/base/+/643b15430b92b743d69ab9d873dc206c213f3b26"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["49714436608044671305293876268688011751", "27235926812117504666227503456781838858", "152131684056357529303359116694599025110", "192237261357507002612339171188052603944", "140495636727712672716440343884166268756", "157719352045282315778688066858686201191", "107884727821770368367347544731045814570", "89816167525425443615835220578845872850"], "threshold":0.9}, "id":"ASB-A-262884935-1cded88a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298", "target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"}}, {"deprecated":false, "digest":{"function_hash":"96375408898447538659536913358771750766", "length":1656}, "id":"ASB-A-262884935-3660e61e", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/643b15430b92b743d69ab9d873dc206c213f3b26", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java", "function":"writeGrantedUriPermissionWithSnapshot"}}, {"deprecated":false, "digest":{"line_hashes":["208066064267241960959440941019057948997", "313737864995091110429460964588625254278", "14117458227292577305935911113212513881", "238051827951220167354838224651315039593", "188418041337602474075491705044948425522", "271409270120930447055350760298209320538", "127777762670012129513346807589712012754", "77828897691903140610541870309814868835", "124206579015600549164449103829268990919", "173509816950935623162542703793514283472", "276836399207426780002331109902106526021", "260997651908002305298770814439457104666", "167984905105034397083832491026409320181", "113223502937592717980155175581986064747", "25551873650588914003464304440811981086", "10360057136569032732299731456835186082", "223611691733174629427932502533012916570", "46989173182728006183241236139019195354", "137577992719925689576038138992345831392", "245096642054775315075274008460296428961", "263901127997092598003410834345461647047"], "threshold":0.9}, "id":"ASB-A-262884935-b1bd5c19", "match_only_versions":["17-qpr2-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/643b15430b92b743d69ab9d873dc206c213f3b26", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"}}, {"deprecated":false, "digest":{"line_hashes":["58670020022276940087647970307836601199", "315148219331921030566269997373448571861", "192086011035144630534812329229620258818", "260287082417008909222784211034295258968", "265790801120572393218953429802584020240", "70653557675873499691925765785249816034", "194811434092391301974013545190413141185", "33150181908758360640020837957982183397", "312895007790225659854354312298784159199", "108408552910146826053673955449778310358", "137696438128835532204806381809806166686", "80797616084554163508356591809675752271", "52950164070929098033575560126105451061", "191019419916906064687848028646737864967", "208333260615160174296918704248449711573", "120723792442756082647344117031437317838", "196131753133668671130504834467997254354", "83127344736328599676001642467244968833", "104119711074550133945869178538437504971", "224275535601845120267244912199302071890", "240785075554445538493757802638685194054", "188146902918788390764632983646377252055", "142361514505696748380105095567532808199", "123664273482389585516345188777816474886", "397119352004599082162725205329512310", "135765611353314023128529939795503747805", "207213090650747517810620129618804091220", "271911949780274440842928288276957635384"], "threshold":0.9}, "id":"ASB-A-262884935-c3678b7b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"275695760622047620742569185681751300143", "length":1673}, "id":"ASB-A-262884935-faa8f7a9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/23a398d0f7a171f5f97c5f13052f9ee3bcf7c298", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java", "function":"writeGrantedUriPermissions"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"275695760622047620742569185681751300143", "length":1673}, "id":"ASB-A-262884935-9eccac08", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java", "function":"writeGrantedUriPermissions"}}, {"deprecated":false, "digest":{"line_hashes":["290186854208823290511265801338864998030", "286340809122951368854389731249383566301", "53154135960009604216752095956444432126", "140495636727712672716440343884166268756", "157719352045282315778688066858686201191", "107884727821770368367347544731045814570", "89816167525425443615835220578845872850"], "threshold":0.9}, "id":"ASB-A-262884935-c2e3e075", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370", "target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"}}, {"deprecated":false, "digest":{"line_hashes":["58670020022276940087647970307836601199", "315148219331921030566269997373448571861", "192086011035144630534812329229620258818", "260287082417008909222784211034295258968", "265790801120572393218953429802584020240", "70653557675873499691925765785249816034", "194811434092391301974013545190413141185", "120723792442756082647344117031437317838", "196131753133668671130504834467997254354", "83127344736328599676001642467244968833", "104119711074550133945869178538437504971", "224275535601845120267244912199302071890", "240785075554445538493757802638685194054", "188146902918788390764632983646377252055", "142361514505696748380105095567532808199", "123664273482389585516345188777816474886", "397119352004599082162725205329512310", "135765611353314023128529939795503747805", "207213090650747517810620129618804091220", "271911949780274440842928288276957635384"], "threshold":0.9}, "id":"ASB-A-262884935-f25b13ba", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e5ba9c7afa4ec0cd21bb78bff820ec0489c9d370", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["49714436608044671305293876268688011751", "27235926812117504666227503456781838858", "152131684056357529303359116694599025110", "192237261357507002612339171188052603944", "140495636727712672716440343884166268756", "157719352045282315778688066858686201191", "107884727821770368367347544731045814570", "89816167525425443615835220578845872850"], "threshold":0.9}, "id":"ASB-A-262884935-27d38d64", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e", "target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"}}, {"deprecated":false, "digest":{"function_hash":"275695760622047620742569185681751300143", "length":1673}, "id":"ASB-A-262884935-82a01014", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java", "function":"writeGrantedUriPermissions"}}, {"deprecated":false, "digest":{"line_hashes":["58670020022276940087647970307836601199", "315148219331921030566269997373448571861", "192086011035144630534812329229620258818", "260287082417008909222784211034295258968", "265790801120572393218953429802584020240", "70653557675873499691925765785249816034", "194811434092391301974013545190413141185", "120723792442756082647344117031437317838", "196131753133668671130504834467997254354", "83127344736328599676001642467244968833", "104119711074550133945869178538437504971", "224275535601845120267244912199302071890", "240785075554445538493757802638685194054", "188146902918788390764632983646377252055", "142361514505696748380105095567532808199", "123664273482389585516345188777816474886", "397119352004599082162725205329512310", "135765611353314023128529939795503747805", "207213090650747517810620129618804091220", "271911949780274440842928288276957635384"], "threshold":0.9}, "id":"ASB-A-262884935-a2f61b5e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8e15f3d9bd60b25a6ff55689c3f69052a970d75e", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["58670020022276940087647970307836601199", "315148219331921030566269997373448571861", "192086011035144630534812329229620258818", "260287082417008909222784211034295258968", "265790801120572393218953429802584020240", "70653557675873499691925765785249816034", "194811434092391301974013545190413141185", "120723792442756082647344117031437317838", "196131753133668671130504834467997254354", "83127344736328599676001642467244968833", "104119711074550133945869178538437504971", "224275535601845120267244912199302071890", "240785075554445538493757802638685194054", "188146902918788390764632983646377252055", "142361514505696748380105095567532808199", "123664273482389585516345188777816474886", "397119352004599082162725205329512310", "135765611353314023128529939795503747805", "207213090650747517810620129618804091220", "271911949780274440842928288276957635384"], "threshold":0.9}, "id":"ASB-A-262884935-17c98f6e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"275695760622047620742569185681751300143", "length":1673}, "id":"ASB-A-262884935-1d4688c8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java", "function":"writeGrantedUriPermissions"}}, {"deprecated":false, "digest":{"line_hashes":["49714436608044671305293876268688011751", "27235926812117504666227503456781838858", "152131684056357529303359116694599025110", "192237261357507002612339171188052603944", "140495636727712672716440343884166268756", "157719352045282315778688066858686201191", "107884727821770368367347544731045814570", "89816167525425443615835220578845872850"], "threshold":0.9}, "id":"ASB-A-262884935-6a7ea539", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/331d75403c4b2046690150e62e11431be3b9497d", "target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["58670020022276940087647970307836601199", "315148219331921030566269997373448571861", "192086011035144630534812329229620258818", "260287082417008909222784211034295258968", "265790801120572393218953429802584020240", "70653557675873499691925765785249816034", "194811434092391301974013545190413141185", "120723792442756082647344117031437317838", "196131753133668671130504834467997254354", "83127344736328599676001642467244968833", "104119711074550133945869178538437504971", "224275535601845120267244912199302071890", "240785075554445538493757802638685194054", "188146902918788390764632983646377252055", "142361514505696748380105095567532808199", "123664273482389585516345188777816474886", "397119352004599082162725205329512310", "135765611353314023128529939795503747805", "207213090650747517810620129618804091220", "271911949780274440842928288276957635384"], "threshold":0.9}, "id":"ASB-A-262884935-6bdd18fc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"275695760622047620742569185681751300143", "length":1673}, "id":"ASB-A-262884935-886f39f9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c", "target":{"file":"services/core/java/com/android/server/uri/UriGrantsManagerService.java", "function":"writeGrantedUriPermissions"}}, {"deprecated":false, "digest":{"line_hashes":["290186854208823290511265801338864998030", "286340809122951368854389731249383566301", "53154135960009604216752095956444432126", "140495636727712672716440343884166268756", "157719352045282315778688066858686201191", "107884727821770368367347544731045814570", "89816167525425443615835220578845872850"], "threshold":0.9}, "id":"ASB-A-262884935-8faa9805", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/aff0672b0394b5f117f6084901a2f06727c0d32c", "target":{"file":"services/core/java/com/android/server/uri/UriPermission.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}