{"id":"ASB-A-438186009", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-24T15:00:40.818157658Z", "aliases":["CVE-2026-0070", "A-438186009"], "details":"In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/79cca47a6201c9debdf5695b240926c3f1944166"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"335149920525558462994404269237638391269", "length":1501}, "id":"ASB-A-438186009-acb24eb4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/79cca47a6201c9debdf5695b240926c3f1944166", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"setApplicationHidden"}}, {"deprecated":false, "digest":{"function_hash":"315259052800142157265435189057750018541", "length":733}, "id":"ASB-A-438186009-d7ed781e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/79cca47a6201c9debdf5695b240926c3f1944166", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"dumpResources"}}, {"deprecated":false, "digest":{"line_hashes":["6092387668215313025417762827665573007", "225272786115913257972947217315642282011", "241405310850211474395422482270537390830", "241687692444606202272449932470876959372", "181397407319905064678244527735915627369", "316298545725525957651624668707700307052", "212627851799453202386643072362596635696", "85498568986254432836380442243385848459", "87636560343521544508148697268323663003", "327663528310505349556952355993999590017", "302498248168541542815919668799669381764"], "threshold":0.9}, "id":"ASB-A-438186009-e97ef8d8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/79cca47a6201c9debdf5695b240926c3f1944166", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/77371d16afb4574acfa78c67bdadb3c08cb53343"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"62305857649003667543974786968857910844", "length":1511}, "id":"ASB-A-438186009-47aa773f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/77371d16afb4574acfa78c67bdadb3c08cb53343", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"setApplicationHidden"}}, {"deprecated":false, "digest":{"function_hash":"315259052800142157265435189057750018541", "length":733}, "id":"ASB-A-438186009-f264896f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/77371d16afb4574acfa78c67bdadb3c08cb53343", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"dumpResources"}}, {"deprecated":false, "digest":{"line_hashes":["6092387668215313025417762827665573007", "225272786115913257972947217315642282011", "241405310850211474395422482270537390830", "241687692444606202272449932470876959372", "181397407319905064678244527735915627369", "316298545725525957651624668707700307052", "212627851799453202386643072362596635696", "55525629966146270102222777748570793405", "317638606902821826831464714837897502373", "327663528310505349556952355993999590017", "302498248168541542815919668799669381764"], "threshold":0.9}, "id":"ASB-A-438186009-fcec9087", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/77371d16afb4574acfa78c67bdadb3c08cb53343", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b4b10f40dfd9ed6b5f150dc78a9844cfdd6be632"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["6092387668215313025417762827665573007", "225272786115913257972947217315642282011", "241405310850211474395422482270537390830", "241687692444606202272449932470876959372", "181397407319905064678244527735915627369", "316298545725525957651624668707700307052", "212627851799453202386643072362596635696", "55525629966146270102222777748570793405", "317638606902821826831464714837897502373", "327663528310505349556952355993999590017", "302498248168541542815919668799669381764"], "threshold":0.9}, "id":"ASB-A-438186009-5700be49", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b4b10f40dfd9ed6b5f150dc78a9844cfdd6be632", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"62305857649003667543974786968857910844", "length":1511}, "id":"ASB-A-438186009-f2364311", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b4b10f40dfd9ed6b5f150dc78a9844cfdd6be632", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"setApplicationHidden"}}, {"deprecated":false, "digest":{"function_hash":"315259052800142157265435189057750018541", "length":733}, "id":"ASB-A-438186009-f2f868e2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b4b10f40dfd9ed6b5f150dc78a9844cfdd6be632", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"dumpResources"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3129a29411bc163eb7ec722bc968d8fa4c67f80f"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"335149920525558462994404269237638391269", "length":1501}, "id":"ASB-A-438186009-1f69c186", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3129a29411bc163eb7ec722bc968d8fa4c67f80f", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"setApplicationHidden"}}, {"deprecated":false, "digest":{"function_hash":"315259052800142157265435189057750018541", "length":733}, "id":"ASB-A-438186009-477ba841", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3129a29411bc163eb7ec722bc968d8fa4c67f80f", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"dumpResources"}}, {"deprecated":false, "digest":{"line_hashes":["6092387668215313025417762827665573007", "225272786115913257972947217315642282011", "241405310850211474395422482270537390830", "241687692444606202272449932470876959372", "181397407319905064678244527735915627369", "316298545725525957651624668707700307052", "212627851799453202386643072362596635696", "85498568986254432836380442243385848459", "87636560343521544508148697268323663003", "327663528310505349556952355993999590017", "302498248168541542815919668799669381764"], "threshold":0.9}, "id":"ASB-A-438186009-d791803f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3129a29411bc163eb7ec722bc968d8fa4c67f80f", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4a97f5239d571788ee26d94a54b7e57f23cbb0d4"], "severity":"High", "spl":"2026-06-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["6092387668215313025417762827665573007", "225272786115913257972947217315642282011", "241405310850211474395422482270537390830", "241687692444606202272449932470876959372", "181397407319905064678244527735915627369", "316298545725525957651624668707700307052", "212627851799453202386643072362596635696", "275285724250142645022066266433608152772", "266128297703753329906982674345792391773", "327663528310505349556952355993999590017", "302498248168541542815919668799669381764"], "threshold":0.9}, "id":"ASB-A-438186009-04a51e0f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4a97f5239d571788ee26d94a54b7e57f23cbb0d4", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"315259052800142157265435189057750018541", "length":733}, "id":"ASB-A-438186009-24e182d7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4a97f5239d571788ee26d94a54b7e57f23cbb0d4", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"dumpResources"}}, {"deprecated":false, "digest":{"function_hash":"229504221062569578636971357235157563497", "length":1965}, "id":"ASB-A-438186009-56a57eb7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4a97f5239d571788ee26d94a54b7e57f23cbb0d4", "target":{"file":"services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java", "function":"setApplicationHidden"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/dc3785a739bc197b6d71fa57ff798423fa51cb6b"}]}