{"id":"ASB-A-460778875", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28642", "A-460778875"], "details":"In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/34bbada3964e240057515958c510ed26f539d527"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"83617715333679498713938988552531908390", "length":12349}, "id":"ASB-A-460778875-78b33743", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/34bbada3964e240057515958c510ed26f539d527", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}, {"deprecated":false, "digest":{"line_hashes":["307820723138045162599877109407216138658", "61273631899735977023115178922223721166", "194777174989804809247450158344163068939"], "threshold":0.9}, "id":"ASB-A-460778875-daf9cee4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/34bbada3964e240057515958c510ed26f539d527", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b8da0df7dc69b443364a604db449be1ee88bf085"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["307820723138045162599877109407216138658", "61273631899735977023115178922223721166", "194777174989804809247450158344163068939"], "threshold":0.9}, "id":"ASB-A-460778875-9f4dfe27", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b8da0df7dc69b443364a604db449be1ee88bf085", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"194603353354813928386930688241192565729", "length":10049}, "id":"ASB-A-460778875-e2b11772", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b8da0df7dc69b443364a604db449be1ee88bf085", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fece5d22e1a9fe302730c60afd3c67f9f9791b64"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["307820723138045162599877109407216138658", "61273631899735977023115178922223721166", "194777174989804809247450158344163068939"], "threshold":0.9}, "id":"ASB-A-460778875-5c567911", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fece5d22e1a9fe302730c60afd3c67f9f9791b64", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"78586203835288815568051385433325372255", "length":11501}, "id":"ASB-A-460778875-5fb20e11", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fece5d22e1a9fe302730c60afd3c67f9f9791b64", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4fb505af662cebe8c11de4d29a2dbf1743d3192a"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["307820723138045162599877109407216138658", "61273631899735977023115178922223721166", "194777174989804809247450158344163068939"], "threshold":0.9}, "id":"ASB-A-460778875-0ea527e9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4fb505af662cebe8c11de4d29a2dbf1743d3192a", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"327269604594323098546494824811363580248", "length":12110}, "id":"ASB-A-460778875-2f57ebb0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4fb505af662cebe8c11de4d29a2dbf1743d3192a", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fb4fc6c38091adcc1d8e7bdf734a48ee10f668f2"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"39425972433370629219603419758825357945", "length":9811}, "id":"ASB-A-460778875-012a0285", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fb4fc6c38091adcc1d8e7bdf734a48ee10f668f2", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"executeRequest"}}, {"deprecated":false, "digest":{"line_hashes":["307820723138045162599877109407216138658", "61273631899735977023115178922223721166", "194777174989804809247450158344163068939"], "threshold":0.9}, "id":"ASB-A-460778875-b04e11dd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fb4fc6c38091adcc1d8e7bdf734a48ee10f668f2", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}