{"id":"ASB-A-332883816", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28626", "A-332883816"], "details":"In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "affected":[{"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-05"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/419fb3da8c29f17bb2d8681d48853fe481baf0ba"], "severity":"High", "spl":"2026-09-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["71942208783563358557226580270672865735", "169678827038952158752333276100582581248", "37418170836468364298968539675364713501", "134130750238688401524396069194677068073", "249394292296510464685928265344639227432", "250448781764467318139100859754884135545", "224707963004023311107968495427054364213", "3300911386987079652467214465728029902"], "threshold":0.9}, "id":"ASB-A-332883816-042165b2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/419fb3da8c29f17bb2d8681d48853fe481baf0ba", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"258747669667375970880117225168403337790", "length":2263}, "id":"ASB-A-332883816-7ac45665", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/419fb3da8c29f17bb2d8681d48853fe481baf0ba", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-05"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/ef6ea1d1f326f7ba4c4c8c5f3a4c5c1f9ff22965"], "severity":"High", "spl":"2026-09-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["71942208783563358557226580270672865735", "169678827038952158752333276100582581248", "37418170836468364298968539675364713501", "134130750238688401524396069194677068073", "249394292296510464685928265344639227432", "250448781764467318139100859754884135545", "224707963004023311107968495427054364213", "3300911386987079652467214465728029902"], "threshold":0.9}, "id":"ASB-A-332883816-1c047a0b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/ef6ea1d1f326f7ba4c4c8c5f3a4c5c1f9ff22965", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"258747669667375970880117225168403337790", "length":2263}, "id":"ASB-A-332883816-ec79d540", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/ef6ea1d1f326f7ba4c4c8c5f3a4c5c1f9ff22965", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-05"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/949f733401724eef85d181a3605201da5d03bd6a"], "severity":"High", "spl":"2026-09-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["71942208783563358557226580270672865735", "169678827038952158752333276100582581248", "37418170836468364298968539675364713501", "134130750238688401524396069194677068073", "249394292296510464685928265344639227432", "250448781764467318139100859754884135545", "224707963004023311107968495427054364213", "3300911386987079652467214465728029902"], "threshold":0.9}, "id":"ASB-A-332883816-4abc9819", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/949f733401724eef85d181a3605201da5d03bd6a", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"258747669667375970880117225168403337790", "length":2263}, "id":"ASB-A-332883816-6496b805", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/949f733401724eef85d181a3605201da5d03bd6a", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-05"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/1778d44a2bad56a1ea19d21150dd458bb4aaa261"], "severity":"High", "spl":"2026-09-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["71942208783563358557226580270672865735", "169678827038952158752333276100582581248", "37418170836468364298968539675364713501", "134130750238688401524396069194677068073", "249394292296510464685928265344639227432", "250448781764467318139100859754884135545", "224707963004023311107968495427054364213", "3300911386987079652467214465728029902"], "threshold":0.9}, "id":"ASB-A-332883816-5228816f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/1778d44a2bad56a1ea19d21150dd458bb4aaa261", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"258747669667375970880117225168403337790", "length":2263}, "id":"ASB-A-332883816-555ce36d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/1778d44a2bad56a1ea19d21150dd458bb4aaa261", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-05"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/5fe9d0c8b19fd0d515dcff8204bffb1c18b24286"], "severity":"High", "spl":"2026-09-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["71942208783563358557226580270672865735", "169678827038952158752333276100582581248", "37418170836468364298968539675364713501", "134130750238688401524396069194677068073", "249394292296510464685928265344639227432", "250448781764467318139100859754884135545", "224707963004023311107968495427054364213", "3300911386987079652467214465728029902"], "threshold":0.9}, "id":"ASB-A-332883816-4b276de5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/5fe9d0c8b19fd0d515dcff8204bffb1c18b24286", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"258747669667375970880117225168403337790", "length":2263}, "id":"ASB-A-332883816-520cdce3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/5fe9d0c8b19fd0d515dcff8204bffb1c18b24286", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/TV", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-05"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/TV/+/513248f88c781c14591f357d1f9bdd998a961751"], "severity":"High", "spl":"2026-09-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"258747669667375970880117225168403337790", "length":2263}, "id":"ASB-A-332883816-e2100705", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/513248f88c781c14591f357d1f9bdd998a961751", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["71942208783563358557226580270672865735", "169678827038952158752333276100582581248", "37418170836468364298968539675364713501", "134130750238688401524396069194677068073", "249394292296510464685928265344639227432", "250448781764467318139100859754884135545", "224707963004023311107968495427054364213", "3300911386987079652467214465728029902"], "threshold":0.9}, "id":"ASB-A-332883816-fa6325fc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/TV/+/513248f88c781c14591f357d1f9bdd998a961751", "target":{"file":"src/com/android/tv/SetupPassthroughActivity.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}