{"id":"ASB-A-429182079", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58989", "A-429182079"], "details":"In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7f9bb1b5e615f031aa8f49adaeba9cac758062e4"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"58843641692405561116398763900677247296", "length":449}, "id":"ASB-A-429182079-36eda020", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7f9bb1b5e615f031aa8f49adaeba9cac758062e4", "target":{"file":"services/core/java/com/android/server/oemlock/OemLockService.java", "function":"setOemUnlockAllowedByUser"}}, {"deprecated":false, "digest":{"line_hashes":["297880842625060905357954905455168146174", "285120567615989224675124832964427182566", "91685311659762911917634782691467810352", "192013408033404563843155183221445358080", "213120363208340397231019579145972232811", "231922727167027481508735651943634885495", "182128733511723708083733918752711026701", "107571502601989328817999047580204506339", "203776309777225035639472435724568064982", "127522153821616804758509570245604115407", "272694874155991502934684844614796278555"], "threshold":0.9}, "id":"ASB-A-429182079-7c253119", "match_only_versions":["17-qpr2-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7f9bb1b5e615f031aa8f49adaeba9cac758062e4", "target":{"file":"services/core/java/com/android/server/oemlock/OemLockService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a383b8d648a4f415e070be4a3fa6126848ed1311"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["297880842625060905357954905455168146174", "285120567615989224675124832964427182566", "91685311659762911917634782691467810352", "192013408033404563843155183221445358080", "213120363208340397231019579145972232811", "231922727167027481508735651943634885495", "182128733511723708083733918752711026701", "107571502601989328817999047580204506339", "203776309777225035639472435724568064982", "127522153821616804758509570245604115407", "272694874155991502934684844614796278555"], "threshold":0.9}, "id":"ASB-A-429182079-331633b5", "match_only_versions":["15"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a383b8d648a4f415e070be4a3fa6126848ed1311", "target":{"file":"services/core/java/com/android/server/oemlock/OemLockService.java"}}, {"deprecated":false, "digest":{"function_hash":"58843641692405561116398763900677247296", "length":449}, "id":"ASB-A-429182079-34470af6", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a383b8d648a4f415e070be4a3fa6126848ed1311", "target":{"file":"services/core/java/com/android/server/oemlock/OemLockService.java", "function":"setOemUnlockAllowedByUser"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7240872771c336689e0c3b34580fa42f7a097a46"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"58843641692405561116398763900677247296", "length":449}, "id":"ASB-A-429182079-43835300", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7240872771c336689e0c3b34580fa42f7a097a46", "target":{"file":"services/core/java/com/android/server/oemlock/OemLockService.java", "function":"setOemUnlockAllowedByUser"}}, {"deprecated":false, "digest":{"line_hashes":["297880842625060905357954905455168146174", "285120567615989224675124832964427182566", "91685311659762911917634782691467810352", "192013408033404563843155183221445358080", "213120363208340397231019579145972232811", "231922727167027481508735651943634885495", "182128733511723708083733918752711026701", "107571502601989328817999047580204506339", "203776309777225035639472435724568064982", "127522153821616804758509570245604115407", "272694874155991502934684844614796278555"], "threshold":0.9}, "id":"ASB-A-429182079-67362ff2", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7240872771c336689e0c3b34580fa42f7a097a46", "target":{"file":"services/core/java/com/android/server/oemlock/OemLockService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3b6778930952fc749c0c7b0f21e1d148419d06c8"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["297880842625060905357954905455168146174", "285120567615989224675124832964427182566", "91685311659762911917634782691467810352", "192013408033404563843155183221445358080", "213120363208340397231019579145972232811", "231922727167027481508735651943634885495", "182128733511723708083733918752711026701", "107571502601989328817999047580204506339", "203776309777225035639472435724568064982", "127522153821616804758509570245604115407", "272694874155991502934684844614796278555"], "threshold":0.9}, "id":"ASB-A-429182079-f9b99880", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b6778930952fc749c0c7b0f21e1d148419d06c8", "target":{"file":"services/core/java/com/android/server/oemlock/OemLockService.java"}}, {"deprecated":false, "digest":{"function_hash":"58843641692405561116398763900677247296", "length":449}, "id":"ASB-A-429182079-fd6cd928", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b6778930952fc749c0c7b0f21e1d148419d06c8", "target":{"file":"services/core/java/com/android/server/oemlock/OemLockService.java", "function":"setOemUnlockAllowedByUser"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}