{"id":"ASB-A-461500706", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28631", "A-461500706"], "details":"In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/426df92120398800fc185c7540f6263a58cbea2d", "https://android.googlesource.com/platform/frameworks/base/+/7722192034b5aa341b46cf7803bad3050cf6a054"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["78139153521333413375691220346111554848", "22117557816079280115461150826927296930", "22236105038616136280216033962554511711", "331192511457113304253531561818596609096"], "threshold":0.9}, "id":"ASB-A-461500706-0496c580", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/426df92120398800fc185c7540f6263a58cbea2d", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"275600975068241849699869813208466523774", "length":1710}, "id":"ASB-A-461500706-0f22c187", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7722192034b5aa341b46cf7803bad3050cf6a054", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["151257780129023544978963930218942193362", "114736881790020246893202071589709360605", "113727632206974886353707745357651912544", "215030698924241381202671228134672837834", "335097099142340031416459041471911055346", "136567066977832655758858044248128329832", "247047352691011741949288614955118646481", "282610005211683422463218026581057951122", "290239436913716466994902491240806381237", "177209998832725559019748183461050806389", "7147032207968402908323949559221056306", "56419335929094113911132560272243684991", "129683992516956698035414025774403438917", "120609988045666988121400073853647420946", "325850132597459714713299309192660703042", "140087489249634326301456327272266307535"], "threshold":0.9}, "id":"ASB-A-461500706-3e9ef8e0", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7722192034b5aa341b46cf7803bad3050cf6a054", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"70802502375059167023747500290520995705", "length":850}, "id":"ASB-A-461500706-6cd8b2a0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/426df92120398800fc185c7540f6263a58cbea2d", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"buildMiniResolver"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/61d262e6eecffba83604886470a28e636b3fac5a", "https://android.googlesource.com/platform/frameworks/base/+/05df4e24983caaf46c9d35d82d5eaa7b7557fbab"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["151257780129023544978963930218942193362", "114736881790020246893202071589709360605", "113727632206974886353707745357651912544", "215030698924241381202671228134672837834", "335097099142340031416459041471911055346", "136567066977832655758858044248128329832", "247047352691011741949288614955118646481", "282610005211683422463218026581057951122", "290239436913716466994902491240806381237", "177209998832725559019748183461050806389", "7147032207968402908323949559221056306", "56419335929094113911132560272243684991", "129683992516956698035414025774403438917", "120609988045666988121400073853647420946", "325850132597459714713299309192660703042", "140087489249634326301456327272266307535"], "threshold":0.9}, "id":"ASB-A-461500706-7953c9ef", "match_only_versions":["15"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/05df4e24983caaf46c9d35d82d5eaa7b7557fbab", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}, {"deprecated":false, "digest":{"line_hashes":["78139153521333413375691220346111554848", "22117557816079280115461150826927296930", "22236105038616136280216033962554511711", "331192511457113304253531561818596609096"], "threshold":0.9}, "id":"ASB-A-461500706-7cef289c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/61d262e6eecffba83604886470a28e636b3fac5a", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"174458064475516220585128677805942495439", "length":910}, "id":"ASB-A-461500706-a04db347", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/61d262e6eecffba83604886470a28e636b3fac5a", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"buildMiniResolver"}}, {"deprecated":false, "digest":{"function_hash":"275600975068241849699869813208466523774", "length":1710}, "id":"ASB-A-461500706-ef700c8a", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/05df4e24983caaf46c9d35d82d5eaa7b7557fbab", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/da0e8bcdd7faefd6a20db1084f4548f879ff709b", "https://android.googlesource.com/platform/frameworks/base/+/a9afcde1ea0991c9e3a64a29a895112af4012d02"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"70802502375059167023747500290520995705", "length":850}, "id":"ASB-A-461500706-58ffae21", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/da0e8bcdd7faefd6a20db1084f4548f879ff709b", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"buildMiniResolver"}}, {"deprecated":false, "digest":{"line_hashes":["78139153521333413375691220346111554848", "22117557816079280115461150826927296930", "22236105038616136280216033962554511711", "331192511457113304253531561818596609096"], "threshold":0.9}, "id":"ASB-A-461500706-8bb494b4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/da0e8bcdd7faefd6a20db1084f4548f879ff709b", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}, {"deprecated":false, "digest":{"line_hashes":["151257780129023544978963930218942193362", "114736881790020246893202071589709360605", "113727632206974886353707745357651912544", "215030698924241381202671228134672837834", "335097099142340031416459041471911055346", "136567066977832655758858044248128329832", "247047352691011741949288614955118646481", "282610005211683422463218026581057951122", "290239436913716466994902491240806381237", "177209998832725559019748183461050806389", "7147032207968402908323949559221056306", "56419335929094113911132560272243684991", "129683992516956698035414025774403438917", "120609988045666988121400073853647420946", "325850132597459714713299309192660703042", "140087489249634326301456327272266307535"], "threshold":0.9}, "id":"ASB-A-461500706-c1946e8c", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a9afcde1ea0991c9e3a64a29a895112af4012d02", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"275600975068241849699869813208466523774", "length":1710}, "id":"ASB-A-461500706-ef05c292", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a9afcde1ea0991c9e3a64a29a895112af4012d02", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c2a300b19cec96eb1f9d7104a024074638a1489d"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"70802502375059167023747500290520995705", "length":850}, "id":"ASB-A-461500706-343519a7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c2a300b19cec96eb1f9d7104a024074638a1489d", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"buildMiniResolver"}}, {"deprecated":false, "digest":{"line_hashes":["78139153521333413375691220346111554848", "22117557816079280115461150826927296930", "22236105038616136280216033962554511711", "331192511457113304253531561818596609096"], "threshold":0.9}, "id":"ASB-A-461500706-9423b083", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c2a300b19cec96eb1f9d7104a024074638a1489d", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6354e06830d76c34a05963ac0e3dade4d4bc9969"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["151257780129023544978963930218942193362", "114736881790020246893202071589709360605", "113727632206974886353707745357651912544", "215030698924241381202671228134672837834", "335097099142340031416459041471911055346", "136567066977832655758858044248128329832", "247047352691011741949288614955118646481", "282610005211683422463218026581057951122", "290239436913716466994902491240806381237", "177209998832725559019748183461050806389", "7147032207968402908323949559221056306", "56419335929094113911132560272243684991", "129683992516956698035414025774403438917", "120609988045666988121400073853647420946", "325850132597459714713299309192660703042", "140087489249634326301456327272266307535"], "threshold":0.9}, "id":"ASB-A-461500706-24d3b0b4", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6354e06830d76c34a05963ac0e3dade4d4bc9969", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"275600975068241849699869813208466523774", "length":1710}, "id":"ASB-A-461500706-56d0842b", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6354e06830d76c34a05963ac0e3dade4d4bc9969", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e838f07168599d15409739b25c8f1f21ffdfd219", "https://android.googlesource.com/platform/frameworks/base/+/b30b08cda230cd13bd343bd35857e9c1cd56f0cc"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["151257780129023544978963930218942193362", "114736881790020246893202071589709360605", "113727632206974886353707745357651912544", "215030698924241381202671228134672837834", "335097099142340031416459041471911055346", "136567066977832655758858044248128329832", "247047352691011741949288614955118646481", "282610005211683422463218026581057951122", "290239436913716466994902491240806381237", "177209998832725559019748183461050806389", "7147032207968402908323949559221056306", "56419335929094113911132560272243684991", "129683992516956698035414025774403438917", "120609988045666988121400073853647420946", "325850132597459714713299309192660703042", "140087489249634326301456327272266307535"], "threshold":0.9}, "id":"ASB-A-461500706-1dd5c6e6", "match_only_versions":["14"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b30b08cda230cd13bd343bd35857e9c1cd56f0cc", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"184516046974447784803309019411650566097", "length":2530}, "id":"ASB-A-461500706-bfbea1f9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e838f07168599d15409739b25c8f1f21ffdfd219", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"maybeShowUserConsentMiniResolver"}}, {"deprecated":false, "digest":{"line_hashes":["207289286970300325222978528348440114263", "43274313884391543354050929222644838433", "41738662658140835377580167144017564658", "131105229186852075314974234120574923066"], "threshold":0.9}, "id":"ASB-A-461500706-c868b5bf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e838f07168599d15409739b25c8f1f21ffdfd219", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"153839060791627352531712220202893375938", "length":2097}, "id":"ASB-A-461500706-e94d97e1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b30b08cda230cd13bd343bd35857e9c1cd56f0cc", "target":{"file":"core/java/com/android/internal/app/IntentForwarderActivity.java", "function":"onCreate"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}