{"id":"ASB-A-457742426", "published":"2026-03-01T00:00:00Z", "modified":"2026-04-30T15:48:46.890647439Z", "aliases":["CVE-2025-48646", "A-457742426"], "details":"In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2-next:0"}, {"fixed":"16-qpr2-next:2026-03-01"}]}], "versions":["16-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3bb240273822e41f3c6911c60d15983a600308f7"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["324028585166329493548411984252408245696", "307109463204520698885786092901245620793", "39161636174679648051048504854770981382", "171720872570521291261049659203054517175", "32534520853975262735972643992383813856"], "threshold":0.9}, "id":"ASB-A-457742426-1d2ada3a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3bb240273822e41f3c6911c60d15983a600308f7", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"299759760344704005543584588669505608000", "length":12148}, "id":"ASB-A-457742426-3f0fd2a0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3bb240273822e41f3c6911c60d15983a600308f7", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-03-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8e6622267809c37fa7989e4f07af3834f39f09e2"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["324028585166329493548411984252408245696", "307109463204520698885786092901245620793", "39161636174679648051048504854770981382", "171720872570521291261049659203054517175", "32534520853975262735972643992383813856"], "threshold":0.9}, "id":"ASB-A-457742426-34c24f00", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8e6622267809c37fa7989e4f07af3834f39f09e2", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"259665429890921792269487332879315628214", "length":9848}, "id":"ASB-A-457742426-77ae697d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8e6622267809c37fa7989e4f07af3834f39f09e2", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-03-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/79fe04dbdf31ab80311069a4d0a7b518d47c31ac"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"78701295937758223163041667361200821217", "length":11300}, "id":"ASB-A-457742426-9ba9863d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/79fe04dbdf31ab80311069a4d0a7b518d47c31ac", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}, {"deprecated":false, "digest":{"line_hashes":["324028585166329493548411984252408245696", "307109463204520698885786092901245620793", "39161636174679648051048504854770981382", "171720872570521291261049659203054517175", "32534520853975262735972643992383813856"], "threshold":0.9}, "id":"ASB-A-457742426-c45f18e5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/79fe04dbdf31ab80311069a4d0a7b518d47c31ac", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-03-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/457e57d550a8f4c33f03a5ed166e8e33b75d53ac"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["324028585166329493548411984252408245696", "307109463204520698885786092901245620793", "39161636174679648051048504854770981382", "171720872570521291261049659203054517175", "32534520853975262735972643992383813856"], "threshold":0.9}, "id":"ASB-A-457742426-4a70c797", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/457e57d550a8f4c33f03a5ed166e8e33b75d53ac", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"153585869389592494641250503836869601552", "length":11909}, "id":"ASB-A-457742426-59b20e45", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/457e57d550a8f4c33f03a5ed166e8e33b75d53ac", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-03-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/286c5ff4d65c683b6aee5ca5c01ceb2c25360643"], "severity":"High", "spl":"2026-03-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"262742690293147103056457670707115294187", "length":9610}, "id":"ASB-A-457742426-82ab8c7b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/286c5ff4d65c683b6aee5ca5c01ceb2c25360643", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}, {"deprecated":false, "digest":{"line_hashes":["324028585166329493548411984252408245696", "307109463204520698885786092901245620793", "39161636174679648051048504854770981382", "171720872570521291261049659203054517175", "32534520853975262735972643992383813856"], "threshold":0.9}, "id":"ASB-A-457742426-f10f7aba", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/286c5ff4d65c683b6aee5ca5c01ceb2c25360643", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-03-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/c148b4fae6347652231d1c4a633f5cc9a8f057f8"}]}