{"id":"ASB-A-418776187", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-45529", "A-418776187"], "details":"In queryInternal of MmsSmsProvider.java, there is a possible way to access MMS/SMS data across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"188880999255660073179596386710294385453", "length":8050}, "id":"ASB-A-418776187-62a83292", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"queryInternal"}}, {"deprecated":false, "digest":{"function_hash":"115852418371893726666298693186447937427", "length":1201}, "id":"ASB-A-418776187-88e507f8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"getTextSearchQuery"}}, {"deprecated":false, "digest":{"line_hashes":["136802329616135471664233362941077006905", "28691711636404942943129151565909700338", "176295319073431672072655273712129123675", "130890650755251801856216703833007809773", "57656358259527680442444063474892333218", "234444472540445350366806441521020852282", "27672492891490450420418580039021852511", "277699879074650758698282896124363268511", "324430731079907372259348064736481606791", "206636778078385431955076262011548960319", "166294208799980148403719571268555688036", "334714996978313036750087516054996875547", "17009633391817132282331189091451115850", "64043474417064679059821076242644881329", "167904958192380504628677465047090773613", "50851629648608132099150825168494814799", "223388432775768910920057459329326454011", "331591775732554817348856681836996512467", "54401603461502414977538245383273933042", "127440859949272792099447129142163832073", "82508640193944607438434798999793587036", "141118416137438315961463853621328794322", "222426755692545485626279487218058586761", "190423102012389054144931852614611045973", "179878819981819191237184392893219388408", "339646452202614701305698831522823050617", "146200940727979671702208086640715949987", "45976166416491864126854898888965939775", "179404774849306018163078825074439384476", "267592098320588670023594456550655836403", "147982133334808742802936746850746640097", "95216263369590486423596158446173485346", "172690904525401890545773017015647306141", "191618558072125599522074271844249386973", "230741775141976062468833322014044448508", "39168555688690438076035169341504214971", "295694830112681881210904075318803043711", "169525461909817483184047107653610640876", "666454788699359580011857178232819547", "109651799666511754100999079828735677537", "4146283051387891575434168388216485067", "223337884050438011219025392804223033222", "169830670116710176435960193379510138940", "124292021272379332837343334135053194440", "218669114776656206751905706704368310351", "57088269784231425612392639252025857389", "126108984648702824450998775405599655909", "248589592794879054592553943597856810635", "63932034346910116701132762504166657525", "67243975172799998017629671600115478660", "321637405442106200371341651925005292639", "214285540124007229306558810116208662907"], "threshold":0.9}, "id":"ASB-A-418776187-ef753f98", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/ad3be1bfd4fc4e41af1628cbae4fc2938a87d9c2", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["136802329616135471664233362941077006905", "28691711636404942943129151565909700338", "176295319073431672072655273712129123675", "130890650755251801856216703833007809773", "235475316097154250275043340527786554024", "242782141094188487992674006370258409236", "189149550968798635948326799958387587076", "116262057794230151559796087261446461593", "125325987970811906526294499378337441650", "176950685375159166537452584878010797564", "46954059598559379852697476943871151861", "121660500326833587347066330108700255257", "197226415908754595787679376049925258294", "175144240918627696706389043163020705352", "20436973763401286396321817216566876575", "330367912133000650234416714133209340575", "89643941187703297761987712821495745751", "179878819981819191237184392893219388408", "339646452202614701305698831522823050617", "159396926117267726652544130574558533213", "144170050329981353372966156665661183281", "262068676558711509831217486618013363205", "68194612853305562036906942959198182537", "147982133334808742802936746850746640097", "188287710402255797747315035948801106767", "284101723383781290022219617540114419816", "293177386928530964471547645786252086508", "15779983341982286451828558391328868055", "39168555688690438076035169341504214971", "107445837503732636214255104317215840241", "310968217894393759923981334338335408596", "169186351662557925778398158417814260479", "129252227524841832480292152920369279699", "44239815851079422320523672381900275345", "223337884050438011219025392804223033222", "169830670116710176435960193379510138940", "124292021272379332837343334135053194440", "218669114776656206751905706704368310351", "57088269784231425612392639252025857389", "126108984648702824450998775405599655909", "255617379624037692455693671586636871365", "292265071202787058271372941685282380925", "53860944455546604474692588456365778634", "113117854547287017753798240285429774943"], "threshold":0.9}, "id":"ASB-A-418776187-446515ad", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"110241711838873038651601426381532248153", "length":907}, "id":"ASB-A-418776187-ba78c27f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"getTextSearchQuery"}}, {"deprecated":false, "digest":{"function_hash":"168282920648873990586701718012200262781", "length":7006}, "id":"ASB-A-418776187-f8754e0b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/547bc965b67a3332e9938bc52aedb776d8ed9619", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"query"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"110241711838873038651601426381532248153", "length":907}, "id":"ASB-A-418776187-29575c51", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"getTextSearchQuery"}}, {"deprecated":false, "digest":{"line_hashes":["136802329616135471664233362941077006905", "28691711636404942943129151565909700338", "176295319073431672072655273712129123675", "130890650755251801856216703833007809773", "235475316097154250275043340527786554024", "242782141094188487992674006370258409236", "189149550968798635948326799958387587076", "116262057794230151559796087261446461593", "125325987970811906526294499378337441650", "176950685375159166537452584878010797564", "46954059598559379852697476943871151861", "121660500326833587347066330108700255257", "197226415908754595787679376049925258294", "175144240918627696706389043163020705352", "20436973763401286396321817216566876575", "330367912133000650234416714133209340575", "89643941187703297761987712821495745751", "179878819981819191237184392893219388408", "339646452202614701305698831522823050617", "159396926117267726652544130574558533213", "144170050329981353372966156665661183281", "262068676558711509831217486618013363205", "68194612853305562036906942959198182537", "147982133334808742802936746850746640097", "188287710402255797747315035948801106767", "284101723383781290022219617540114419816", "293177386928530964471547645786252086508", "15779983341982286451828558391328868055", "39168555688690438076035169341504214971", "107445837503732636214255104317215840241", "310968217894393759923981334338335408596", "169186351662557925778398158417814260479", "129252227524841832480292152920369279699", "44239815851079422320523672381900275345", "223337884050438011219025392804223033222", "169830670116710176435960193379510138940", "124292021272379332837343334135053194440", "218669114776656206751905706704368310351", "57088269784231425612392639252025857389", "126108984648702824450998775405599655909", "255617379624037692455693671586636871365", "292265071202787058271372941685282380925", "53860944455546604474692588456365778634", "113117854547287017753798240285429774943"], "threshold":0.9}, "id":"ASB-A-418776187-72526307", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"168282920648873990586701718012200262781", "length":7006}, "id":"ASB-A-418776187-c9111547", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/e1b034dfe8f4ac955c80d70f0a23c3317e2a0b11", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"query"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"110241711838873038651601426381532248153", "length":907}, "id":"ASB-A-418776187-54b093a7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"getTextSearchQuery"}}, {"deprecated":false, "digest":{"function_hash":"168282920648873990586701718012200262781", "length":7006}, "id":"ASB-A-418776187-764e4a67", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"query"}}, {"deprecated":false, "digest":{"line_hashes":["136802329616135471664233362941077006905", "28691711636404942943129151565909700338", "176295319073431672072655273712129123675", "130890650755251801856216703833007809773", "235475316097154250275043340527786554024", "242782141094188487992674006370258409236", "189149550968798635948326799958387587076", "116262057794230151559796087261446461593", "125325987970811906526294499378337441650", "176950685375159166537452584878010797564", "46954059598559379852697476943871151861", "121660500326833587347066330108700255257", "197226415908754595787679376049925258294", "175144240918627696706389043163020705352", "20436973763401286396321817216566876575", "330367912133000650234416714133209340575", "89643941187703297761987712821495745751", "179878819981819191237184392893219388408", "339646452202614701305698831522823050617", "159396926117267726652544130574558533213", "144170050329981353372966156665661183281", "262068676558711509831217486618013363205", "68194612853305562036906942959198182537", "147982133334808742802936746850746640097", "188287710402255797747315035948801106767", "284101723383781290022219617540114419816", "293177386928530964471547645786252086508", "15779983341982286451828558391328868055", "39168555688690438076035169341504214971", "107445837503732636214255104317215840241", "310968217894393759923981334338335408596", "169186351662557925778398158417814260479", "129252227524841832480292152920369279699", "44239815851079422320523672381900275345", "223337884050438011219025392804223033222", "169830670116710176435960193379510138940", "124292021272379332837343334135053194440", "218669114776656206751905706704368310351", "57088269784231425612392639252025857389", "126108984648702824450998775405599655909", "255617379624037692455693671586636871365", "292265071202787058271372941685282380925", "53860944455546604474692588456365778634", "113117854547287017753798240285429774943"], "threshold":0.9}, "id":"ASB-A-418776187-85d71857", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/52d9e2fb128fc5b89022f47d96451c5598dcf05a", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"115852418371893726666298693186447937427", "length":1201}, "id":"ASB-A-418776187-1200fa83", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"getTextSearchQuery"}}, {"deprecated":false, "digest":{"line_hashes":["136802329616135471664233362941077006905", "28691711636404942943129151565909700338", "176295319073431672072655273712129123675", "130890650755251801856216703833007809773", "57656358259527680442444063474892333218", "234444472540445350366806441521020852282", "27672492891490450420418580039021852511", "277699879074650758698282896124363268511", "324430731079907372259348064736481606791", "206636778078385431955076262011548960319", "166294208799980148403719571268555688036", "334714996978313036750087516054996875547", "17009633391817132282331189091451115850", "64043474417064679059821076242644881329", "167904958192380504628677465047090773613", "50851629648608132099150825168494814799", "223388432775768910920057459329326454011", "331591775732554817348856681836996512467", "54401603461502414977538245383273933042", "127440859949272792099447129142163832073", "82508640193944607438434798999793587036", "141118416137438315961463853621328794322", "222426755692545485626279487218058586761", "190423102012389054144931852614611045973", "179878819981819191237184392893219388408", "339646452202614701305698831522823050617", "146200940727979671702208086640715949987", "45976166416491864126854898888965939775", "179404774849306018163078825074439384476", "267592098320588670023594456550655836403", "147982133334808742802936746850746640097", "95216263369590486423596158446173485346", "172690904525401890545773017015647306141", "191618558072125599522074271844249386973", "230741775141976062468833322014044448508", "39168555688690438076035169341504214971", "295694830112681881210904075318803043711", "169525461909817483184047107653610640876", "666454788699359580011857178232819547", "109651799666511754100999079828735677537", "4146283051387891575434168388216485067", "223337884050438011219025392804223033222", "169830670116710176435960193379510138940", "124292021272379332837343334135053194440", "218669114776656206751905706704368310351", "57088269784231425612392639252025857389", "126108984648702824450998775405599655909", "248589592794879054592553943597856810635", "63932034346910116701132762504166657525", "67243975172799998017629671600115478660", "321637405442106200371341651925005292639", "214285540124007229306558810116208662907"], "threshold":0.9}, "id":"ASB-A-418776187-76cc1123", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"188880999255660073179596386710294385453", "length":8050}, "id":"ASB-A-418776187-ac5bcc8a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/23db352dbb9c6493d017db2662cfd4192f41e061", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"queryInternal"}}]}}, {"package":{"name":"platform/packages/providers/TelephonyProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["136802329616135471664233362941077006905", "28691711636404942943129151565909700338", "176295319073431672072655273712129123675", "130890650755251801856216703833007809773", "235475316097154250275043340527786554024", "242782141094188487992674006370258409236", "189149550968798635948326799958387587076", "116262057794230151559796087261446461593", "125325987970811906526294499378337441650", "176950685375159166537452584878010797564", "46954059598559379852697476943871151861", "121660500326833587347066330108700255257", "197226415908754595787679376049925258294", "175144240918627696706389043163020705352", "20436973763401286396321817216566876575", "330367912133000650234416714133209340575", "89643941187703297761987712821495745751", "179878819981819191237184392893219388408", "339646452202614701305698831522823050617", "159396926117267726652544130574558533213", "144170050329981353372966156665661183281", "262068676558711509831217486618013363205", "68194612853305562036906942959198182537", "147982133334808742802936746850746640097", "188287710402255797747315035948801106767", "284101723383781290022219617540114419816", "293177386928530964471547645786252086508", "15779983341982286451828558391328868055", "39168555688690438076035169341504214971", "107445837503732636214255104317215840241", "310968217894393759923981334338335408596", "169186351662557925778398158417814260479", "129252227524841832480292152920369279699", "44239815851079422320523672381900275345", "223337884050438011219025392804223033222", "169830670116710176435960193379510138940", "124292021272379332837343334135053194440", "218669114776656206751905706704368310351", "57088269784231425612392639252025857389", "126108984648702824450998775405599655909", "255617379624037692455693671586636871365", "292265071202787058271372941685282380925", "53860944455546604474692588456365778634", "113117854547287017753798240285429774943"], "threshold":0.9}, "id":"ASB-A-418776187-44575b22", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"110241711838873038651601426381532248153", "length":907}, "id":"ASB-A-418776187-4f7918d0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"getTextSearchQuery"}}, {"deprecated":false, "digest":{"function_hash":"223011726168340967236817226657965545269", "length":6850}, "id":"ASB-A-418776187-c1c797e5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/68b319556caefd66ad5209aafbe8dd9b7b088669", "target":{"file":"src/com/android/providers/telephony/MmsSmsProvider.java", "function":"query"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}