{"id":"ASB-A-329233015", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-11T15:42:03.104094163Z", "aliases":["CVE-2026-28613", "A-329233015"], "details":"In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "affected":[{"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/415d636eb465a20ddcdd12244e675cdf18971f7b"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["125903331997634824313909372045928403101", "331113026861862374895474285209768846213", "338327705831313875220268959582057108590", "11809828591642118921488302570555839644", "187140409983236949167563400933486793273", "224521677386353263215494778810229768251", "280341753752157569741377043583314714858", "212711621034491089131739578336956106022", "178991285254059016134939756305430537558"], "threshold":0.9}, "id":"ASB-A-329233015-e06ad465", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/415d636eb465a20ddcdd12244e675cdf18971f7b", "target":{"file":"src/com/android/tv/data/ChannelImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"196249853139039549830237051170712129000", "length":1363}, "id":"ASB-A-329233015-fc4eea82", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/415d636eb465a20ddcdd12244e675cdf18971f7b", "target":{"file":"src/com/android/tv/data/ChannelImpl.java", "function":"initAppLinkTypeAndIntent"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/2a006313f82e6339b71fb3f7090c40d44bf28d2f"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["125903331997634824313909372045928403101", "331113026861862374895474285209768846213", "338327705831313875220268959582057108590", "11809828591642118921488302570555839644", "187140409983236949167563400933486793273", "224521677386353263215494778810229768251", "280341753752157569741377043583314714858", "212711621034491089131739578336956106022", "178991285254059016134939756305430537558"], "threshold":0.9}, "id":"ASB-A-329233015-35876192", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/2a006313f82e6339b71fb3f7090c40d44bf28d2f", "target":{"file":"src/com/android/tv/data/ChannelImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"196249853139039549830237051170712129000", "length":1363}, "id":"ASB-A-329233015-e0758b38", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/2a006313f82e6339b71fb3f7090c40d44bf28d2f", "target":{"file":"src/com/android/tv/data/ChannelImpl.java", "function":"initAppLinkTypeAndIntent"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/a0ee38f7a4f4560fbb9b69b53ff02318eaeb645a"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["125903331997634824313909372045928403101", "331113026861862374895474285209768846213", "338327705831313875220268959582057108590", "11809828591642118921488302570555839644", "187140409983236949167563400933486793273", "224521677386353263215494778810229768251", "280341753752157569741377043583314714858", "212711621034491089131739578336956106022", "178991285254059016134939756305430537558"], "threshold":0.9}, "id":"ASB-A-329233015-82f42b71", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/a0ee38f7a4f4560fbb9b69b53ff02318eaeb645a", "target":{"file":"src/com/android/tv/data/ChannelImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"196249853139039549830237051170712129000", "length":1363}, "id":"ASB-A-329233015-d829e703", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/a0ee38f7a4f4560fbb9b69b53ff02318eaeb645a", "target":{"file":"src/com/android/tv/data/ChannelImpl.java", "function":"initAppLinkTypeAndIntent"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/3cd46ba2b7d4da6ed42fba704bd043e0775e6b20"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"196249853139039549830237051170712129000", "length":1363}, "id":"ASB-A-329233015-7cfd7b59", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/3cd46ba2b7d4da6ed42fba704bd043e0775e6b20", "target":{"file":"src/com/android/tv/data/ChannelImpl.java", "function":"initAppLinkTypeAndIntent"}}, {"deprecated":false, "digest":{"line_hashes":["125903331997634824313909372045928403101", "331113026861862374895474285209768846213", "338327705831313875220268959582057108590", "11809828591642118921488302570555839644", "187140409983236949167563400933486793273", "224521677386353263215494778810229768251", "280341753752157569741377043583314714858", "212711621034491089131739578336956106022", "178991285254059016134939756305430537558"], "threshold":0.9}, "id":"ASB-A-329233015-c77ffae1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/3cd46ba2b7d4da6ed42fba704bd043e0775e6b20", "target":{"file":"src/com/android/tv/data/ChannelImpl.java"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/18b8cdfa88c81d5304a4697733c3c639bc480727"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"196249853139039549830237051170712129000", "length":1363}, "id":"ASB-A-329233015-e395d564", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/18b8cdfa88c81d5304a4697733c3c639bc480727", "target":{"file":"src/com/android/tv/data/ChannelImpl.java", "function":"initAppLinkTypeAndIntent"}}, {"deprecated":false, "digest":{"line_hashes":["125903331997634824313909372045928403101", "331113026861862374895474285209768846213", "338327705831313875220268959582057108590", "11809828591642118921488302570555839644", "187140409983236949167563400933486793273", "224521677386353263215494778810229768251", "280341753752157569741377043583314714858", "212711621034491089131739578336956106022", "178991285254059016134939756305430537558"], "threshold":0.9}, "id":"ASB-A-329233015-e938062e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/18b8cdfa88c81d5304a4697733c3c639bc480727", "target":{"file":"src/com/android/tv/data/ChannelImpl.java"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/7648d0a746a191612c97ac9c581c1ebc3b13fa2a"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["125903331997634824313909372045928403101", "331113026861862374895474285209768846213", "338327705831313875220268959582057108590", "11809828591642118921488302570555839644", "187140409983236949167563400933486793273", "224521677386353263215494778810229768251", "280341753752157569741377043583314714858", "212711621034491089131739578336956106022", "178991285254059016134939756305430537558"], "threshold":0.9}, "id":"ASB-A-329233015-194518ee", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/7648d0a746a191612c97ac9c581c1ebc3b13fa2a", "target":{"file":"src/com/android/tv/data/ChannelImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"196249853139039549830237051170712129000", "length":1363}, "id":"ASB-A-329233015-4c5db74f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/7648d0a746a191612c97ac9c581c1ebc3b13fa2a", "target":{"file":"src/com/android/tv/data/ChannelImpl.java", "function":"initAppLinkTypeAndIntent"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}