{"id":"ASB-A-453649815", "published":"2026-03-01T00:00:00Z", "modified":"2026-05-01T15:24:27.653932157Z", "aliases":["CVE-2026-0020", "A-453649815"], "details":"In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2-next:0"}, {"fixed":"16-qpr2-next:2026-03-01"}]}], "versions":["16-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["196274197830684393603816840329676925730", "2404267374424135568335899747231607115", "300463444893902331628350183110238282543", "93880748564658568240213823021265883614", "299284021734725228359553138313644958845", "338971611199277947813557304818585601362", "107903467293318276817457347624333649939", "241354316311511334352956278769152469088", "109641792464862920889058802367256591500", "311121239974498965218535932728880710853"], "threshold":0.9}, "id":"ASB-A-453649815-5fb2132a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"}}, {"deprecated":false, "digest":{"function_hash":"307197250383847921553552304388472930776", "length":1701}, "id":"ASB-A-453649815-66e54a7a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionGroup"}}, {"deprecated":false, "digest":{"function_hash":"75410298483051398371478044204999183565", "length":1362}, "id":"ASB-A-453649815-8899fee9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionTree"}}, {"deprecated":false, "digest":{"function_hash":"214181287774654884996589223407677553740", "length":4496}, "id":"ASB-A-453649815-eaf9f100", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/595cf99ecd42927eebf804638a4623313f3f14db", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermission"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-03-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"307197250383847921553552304388472930776", "length":1701}, "id":"ASB-A-453649815-111c2f02", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionGroup"}}, {"deprecated":false, "digest":{"line_hashes":["196274197830684393603816840329676925730", "2404267374424135568335899747231607115", "300463444893902331628350183110238282543", "93880748564658568240213823021265883614", "299284021734725228359553138313644958845", "338971611199277947813557304818585601362", "107903467293318276817457347624333649939", "241354316311511334352956278769152469088", "109641792464862920889058802367256591500", "311121239974498965218535932728880710853"], "threshold":0.9}, "id":"ASB-A-453649815-2675b079", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"}}, {"deprecated":false, "digest":{"function_hash":"75410298483051398371478044204999183565", "length":1362}, "id":"ASB-A-453649815-3fdc0d26", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionTree"}}, {"deprecated":false, "digest":{"function_hash":"171546194080724224317806436492206797025", "length":3787}, "id":"ASB-A-453649815-4434035d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/63f06715cc924477ccb043e99df0592c75f2bbfc", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermission"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-03-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"75410298483051398371478044204999183565", "length":1362}, "id":"ASB-A-453649815-6300a20d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionTree"}}, {"deprecated":false, "digest":{"function_hash":"9964124652194516891401584017719602327", "length":3992}, "id":"ASB-A-453649815-cff4cbc0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermission"}}, {"deprecated":false, "digest":{"function_hash":"307197250383847921553552304388472930776", "length":1701}, "id":"ASB-A-453649815-fa351a84", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionGroup"}}, {"deprecated":false, "digest":{"line_hashes":["196274197830684393603816840329676925730", "2404267374424135568335899747231607115", "300463444893902331628350183110238282543", "93880748564658568240213823021265883614", "299284021734725228359553138313644958845", "338971611199277947813557304818585601362", "107903467293318276817457347624333649939", "241354316311511334352956278769152469088", "109641792464862920889058802367256591500", "311121239974498965218535932728880710853"], "threshold":0.9}, "id":"ASB-A-453649815-ff253965", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/08ea2a452c271ccf258d63efc0126c7fa13d3312", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-03-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"75410298483051398371478044204999183565", "length":1362}, "id":"ASB-A-453649815-17c79233", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionTree"}}, {"deprecated":false, "digest":{"function_hash":"307197250383847921553552304388472930776", "length":1701}, "id":"ASB-A-453649815-b9e138c4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionGroup"}}, {"deprecated":false, "digest":{"line_hashes":["196274197830684393603816840329676925730", "2404267374424135568335899747231607115", "300463444893902331628350183110238282543", "93880748564658568240213823021265883614", "299284021734725228359553138313644958845", "338971611199277947813557304818585601362", "107903467293318276817457347624333649939", "241354316311511334352956278769152469088", "109641792464862920889058802367256591500", "311121239974498965218535932728880710853"], "threshold":0.9}, "id":"ASB-A-453649815-d46bc88c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java"}}, {"deprecated":false, "digest":{"function_hash":"100367624945478362435341245134677640622", "length":4259}, "id":"ASB-A-453649815-f1510039", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6934adbe2d1d9391129bd787b04850521c0599b9", "target":{"file":"core/java/com/android/internal/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermission"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-03-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"307197250383847921553552304388472930776", "length":1701}, "id":"ASB-A-453649815-55529ef4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159", "target":{"file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionGroup"}}, {"deprecated":false, "digest":{"line_hashes":["196274197830684393603816840329676925730", "2404267374424135568335899747231607115", "300463444893902331628350183110238282543", "104168900281175770704150283408488404420", "213408616555746969833058379049904554895", "241245247665758687246550798032403209503", "107903467293318276817457347624333649939", "241354316311511334352956278769152469088", "109641792464862920889058802367256591500", "311121239974498965218535932728880710853"], "threshold":0.9}, "id":"ASB-A-453649815-69518bc1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159", "target":{"file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java"}}, {"deprecated":false, "digest":{"function_hash":"171546194080724224317806436492206797025", "length":3787}, "id":"ASB-A-453649815-8410f889", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159", "target":{"file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermission"}}, {"deprecated":false, "digest":{"function_hash":"75410298483051398371478044204999183565", "length":1362}, "id":"ASB-A-453649815-8e4ece56", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5e30118949570617b63722e0e994efa7eb043159", "target":{"file":"services/core/java/com/android/server/pm/pkg/component/ParsedPermissionUtils.java", "function":"parsePermissionTree"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-03-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/e770e9f0234158f4631c7147b64a1d70e0843d0b"}]}