{"id":"ASB-A-460933604", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-26T15:22:10.377767615Z", "aliases":["CVE-2026-0016", "A-460933604"], "details":"In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["236757797298643586277567079489527692433", "260400859541391930397799917262971480305", "89796163820097067758905871865778352977", "152470181634356134627737138537383340738", "19337287797833759647307589339832905124", "26261039252615956348419202102995204716", "40656838338137506166043175060196105359", "203996167164111863555529920133933214782", "33185206605665109979423100066898173404", "165686225044220713529576350913828951629", "335057009792386384466136480693084522621", "205890249286301262013717503706130497784", "238686073049658378032961040442748498945", "68799971003637895160595676149811163745", "98800465716778407554145470769434258469", "297939398198302139966976124503099166615", "244684080444139417345540975757663496257", "65670089475461021476906667660325210385", "339607428233238850237374646557154643291", "217431951705329233002013900317071296733", "100169523158442018145175155576939804633", "275161592794845742554827089389965258716", "45597638232354367525610921186700034828", "39841570399783724898653025584690605558", "27100486196900892471356722060236511558", "244912167370129635279597947671894268558", "218549456482241477253132316775158941870"], "threshold":0.9}, "id":"ASB-A-460933604-0427ac15", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357", "target":{"file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"292971561053830502429299222423501722906", "length":252}, "id":"ASB-A-460933604-0c8385f0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357", "target":{"file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java", "function":"removeInvalidCachedServicesLocked"}}, {"deprecated":false, "digest":{"function_hash":"74419033187255781104100432760116064829", "length":1224}, "id":"ASB-A-460933604-61fdc99e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357", "target":{"file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java", "function":"updateProvidersWhenServiceRemoved"}}, {"deprecated":false, "digest":{"line_hashes":["231003889080206413797443448172764758858", "117066040151103728792130533856058562185", "148201188374718905640009909042790610070", "146396725481014504161548083299177762175", "200303445894465411110734461672330751593"], "threshold":0.9}, "id":"ASB-A-460933604-f63334c0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a631806c7aef2d0adf40793883957956aaada357", "target":{"file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6", "https://android.googlesource.com/platform/frameworks/base/+/67619d9eb580710bc82a2bbf95677d41476c6bef"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"74419033187255781104100432760116064829", "length":1224}, "id":"ASB-A-460933604-2198582f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6", "target":{"file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java", "function":"updateProvidersWhenServiceRemoved"}}, {"deprecated":false, "digest":{"line_hashes":["231003889080206413797443448172764758858", "117066040151103728792130533856058562185", "148201188374718905640009909042790610070", "146396725481014504161548083299177762175", "200303445894465411110734461672330751593"], "threshold":0.9}, "id":"ASB-A-460933604-afd882d6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6", "target":{"file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java"}}, {"deprecated":false, "digest":{"function_hash":"292971561053830502429299222423501722906", "length":252}, "id":"ASB-A-460933604-e2834c21", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6", "target":{"file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java", "function":"removeInvalidCachedServicesLocked"}}, {"deprecated":false, "digest":{"line_hashes":["40656838338137506166043175060196105359", "203996167164111863555529920133933214782", "33185206605665109979423100066898173404", "165686225044220713529576350913828951629", "335057009792386384466136480693084522621", "98800465716778407554145470769434258469", "297939398198302139966976124503099166615", "244684080444139417345540975757663496257", "65670089475461021476906667660325210385", "339607428233238850237374646557154643291", "275161592794845742554827089389965258716", "45597638232354367525610921186700034828", "39841570399783724898653025584690605558", "27100486196900892471356722060236511558"], "threshold":0.9}, "id":"ASB-A-460933604-febaffa7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8458cfc84b460c37a9936f40f80dc960419b51b6", "target":{"file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c", "https://android.googlesource.com/platform/frameworks/base/+/509569d8352076426523cd7c01891880c0a90307"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["203996167164111863555529920133933214782", "33185206605665109979423100066898173404", "165686225044220713529576350913828951629", "335057009792386384466136480693084522621", "68799971003637895160595676149811163745", "98800465716778407554145470769434258469", "297939398198302139966976124503099166615", "244684080444139417345540975757663496257", "65670089475461021476906667660325210385", "339607428233238850237374646557154643291", "275161592794845742554827089389965258716", "45597638232354367525610921186700034828", "39841570399783724898653025584690605558", "27100486196900892471356722060236511558"], "threshold":0.9}, "id":"ASB-A-460933604-65bf59e4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c", "target":{"file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"292971561053830502429299222423501722906", "length":252}, "id":"ASB-A-460933604-73b68a7a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c", "target":{"file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java", "function":"removeInvalidCachedServicesLocked"}}, {"deprecated":false, "digest":{"line_hashes":["231003889080206413797443448172764758858", "117066040151103728792130533856058562185", "148201188374718905640009909042790610070", "146396725481014504161548083299177762175", "200303445894465411110734461672330751593"], "threshold":0.9}, "id":"ASB-A-460933604-aff997d4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c", "target":{"file":"services/core/java/com/android/server/infra/AbstractMasterSystemService.java"}}, {"deprecated":false, "digest":{"function_hash":"74419033187255781104100432760116064829", "length":1224}, "id":"ASB-A-460933604-bffd0aea", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ce3708dbb0316d93ebb441f416d3cd1945f7221c", "target":{"file":"services/credentials/java/com/android/server/credentials/CredentialManagerService.java", "function":"updateProvidersWhenServiceRemoved"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/10b748dbc3488c8deb232f47b923c93d8ab01371"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/ffdfa5c70fcaeabb63ef0ec41c33acd2466316dd"}]}