{"id":"ASB-A-466379326", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-28645", "A-466379326"], "details":"In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d1d84790170ed14a43e94916b2a72705a28ed120"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"154425220503887926437955666012319712863", "length":379}, "id":"ASB-A-466379326-4951796b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d1d84790170ed14a43e94916b2a72705a28ed120", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"onStrongAuthRequiredChanged"}}, {"deprecated":false, "digest":{"function_hash":"329843847068552324655743178063563805308", "length":68}, "id":"ASB-A-466379326-726ad265", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d1d84790170ed14a43e94916b2a72705a28ed120", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"StrongAuthTracker"}}, {"deprecated":false, "digest":{"line_hashes":["14135717664980774877326940435207113668", "208838257019120888967029492057812988734", "303980997206777082058236167758998550078", "258246696498638717619289475853458000045", "246551343149370064425642235722156218478", "83469962468524913589845419853553986518", "47659304363336278112407531927013924706", "69354891173357740875382065604565404025", "65732332423169984516154460319704600921", "281539077955874376535633721848932842277", "201361504904559087994707938912319911071", "14453627472059716073492930783196928421", "142908405981069175745047548176438908229", "313787326944162827791376250620130931150", "106024859502867110267419687826994238575", "209913841649926796741846809279602232275", "298090012230477056240749392424569058539", "146191834689988354582861061796100917605", "12102003753047298497756989403829790547", "288536425967749295275228198138937206395", "123259814890229235172367641832624658585", "313895290493904623434744421914978062168", "74413670498046396838933548594788388058", "208117407908900600207618631210575715878", "185314699748882036841895225554119519059"], "threshold":0.9}, "id":"ASB-A-466379326-cbe4a67c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d1d84790170ed14a43e94916b2a72705a28ed120", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0948da33412d71d92ff492f020ce7ed969b81dc3"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["102241572269453843460507618342099680170", "208582032463455965507622451425207455213", "38898817695566244028862529412608167728", "286926626640485404869481602976069826770", "293576382477151733515474328048855001981", "321550460456259090372856488170391641133", "138563494391990683285167269512389119437", "303980997206777082058236167758998550078", "258246696498638717619289475853458000045", "246551343149370064425642235722156218478", "296342631543126687628208183122482609900", "68159535893293199116900970964224433832", "102492766261531378121582706954893243587", "201361504904559087994707938912319911071", "14453627472059716073492930783196928421", "142908405981069175745047548176438908229", "313787326944162827791376250620130931150", "106024859502867110267419687826994238575", "209913841649926796741846809279602232275", "298090012230477056240749392424569058539", "266060926842948814330620359542701948143", "236126259269540262345731845388030952395", "301149630119402721933085596143639699477", "198485790475347994814906935949157507616", "118615365018110428008084428017238467684"], "threshold":0.9}, "id":"ASB-A-466379326-26ac7e83", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0948da33412d71d92ff492f020ce7ed969b81dc3", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"}}, {"deprecated":false, "digest":{"function_hash":"153934195309772974872074535054637388342", "length":359}, "id":"ASB-A-466379326-533e8f53", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0948da33412d71d92ff492f020ce7ed969b81dc3", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"onStrongAuthRequiredChanged"}}, {"deprecated":false, "digest":{"function_hash":"329843847068552324655743178063563805308", "length":68}, "id":"ASB-A-466379326-a63242a0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0948da33412d71d92ff492f020ce7ed969b81dc3", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"StrongAuthTracker"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fea130396d83cf4fcf931880fe86acc384ecfb20"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["101618585289182684857354010888673946506", "109673027652773160251131906237311162554", "104068313783911841467637249532174009283", "307337615482527339798194465528826848013", "14135717664980774877326940435207113668", "208838257019120888967029492057812988734", "303980997206777082058236167758998550078", "258246696498638717619289475853458000045", "246551343149370064425642235722156218478", "296342631543126687628208183122482609900", "68159535893293199116900970964224433832", "102492766261531378121582706954893243587", "201361504904559087994707938912319911071", "14453627472059716073492930783196928421", "142908405981069175745047548176438908229", "313787326944162827791376250620130931150", "106024859502867110267419687826994238575", "209913841649926796741846809279602232275", "298090012230477056240749392424569058539", "146191834689988354582861061796100917605", "12102003753047298497756989403829790547", "165738275013058604175747402476153113074", "50765511494851665447417845033293331796", "318764030193275878688521655056416273090", "193674767731532334346029463426109540076", "320893116675993848067962957191224473875", "185314699748882036841895225554119519059"], "threshold":0.9}, "id":"ASB-A-466379326-01b4d059", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fea130396d83cf4fcf931880fe86acc384ecfb20", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"}}, {"deprecated":false, "digest":{"function_hash":"104120188869158194378484268374750053020", "length":404}, "id":"ASB-A-466379326-28f449c5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fea130396d83cf4fcf931880fe86acc384ecfb20", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"onStrongAuthRequiredChanged"}}, {"deprecated":false, "digest":{"function_hash":"329843847068552324655743178063563805308", "length":68}, "id":"ASB-A-466379326-d8cf10cc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fea130396d83cf4fcf931880fe86acc384ecfb20", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"StrongAuthTracker"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/552f2ccadd3f8a30867150393afa5702886b9f30"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"154425220503887926437955666012319712863", "length":379}, "id":"ASB-A-466379326-7e8edf88", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/552f2ccadd3f8a30867150393afa5702886b9f30", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"onStrongAuthRequiredChanged"}}, {"deprecated":false, "digest":{"function_hash":"329843847068552324655743178063563805308", "length":68}, "id":"ASB-A-466379326-de9c4b76", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/552f2ccadd3f8a30867150393afa5702886b9f30", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"StrongAuthTracker"}}, {"deprecated":false, "digest":{"line_hashes":["14135717664980774877326940435207113668", "208838257019120888967029492057812988734", "303980997206777082058236167758998550078", "258246696498638717619289475853458000045", "246551343149370064425642235722156218478", "83469962468524913589845419853553986518", "47659304363336278112407531927013924706", "69354891173357740875382065604565404025", "65732332423169984516154460319704600921", "281539077955874376535633721848932842277", "201361504904559087994707938912319911071", "14453627472059716073492930783196928421", "142908405981069175745047548176438908229", "313787326944162827791376250620130931150", "106024859502867110267419687826994238575", "209913841649926796741846809279602232275", "298090012230477056240749392424569058539", "146191834689988354582861061796100917605", "12102003753047298497756989403829790547", "288536425967749295275228198138937206395", "123259814890229235172367641832624658585", "313895290493904623434744421914978062168", "74413670498046396838933548594788388058", "208117407908900600207618631210575715878", "185314699748882036841895225554119519059"], "threshold":0.9}, "id":"ASB-A-466379326-f2fe464f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/552f2ccadd3f8a30867150393afa5702886b9f30", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fa49f9f4ba37a8c65c27cc03ff1718abc6fc32b5"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"329843847068552324655743178063563805308", "length":68}, "id":"ASB-A-466379326-737ff0ed", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fa49f9f4ba37a8c65c27cc03ff1718abc6fc32b5", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"StrongAuthTracker"}}, {"deprecated":false, "digest":{"function_hash":"154425220503887926437955666012319712863", "length":379}, "id":"ASB-A-466379326-f2fda996", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fa49f9f4ba37a8c65c27cc03ff1718abc6fc32b5", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java", "function":"onStrongAuthRequiredChanged"}}, {"deprecated":false, "digest":{"line_hashes":["14135717664980774877326940435207113668", "208838257019120888967029492057812988734", "303980997206777082058236167758998550078", "258246696498638717619289475853458000045", "246551343149370064425642235722156218478", "83469962468524913589845419853553986518", "47659304363336278112407531927013924706", "69354891173357740875382065604565404025", "65732332423169984516154460319704600921", "281539077955874376535633721848932842277", "201361504904559087994707938912319911071", "14453627472059716073492930783196928421", "142908405981069175745047548176438908229", "313787326944162827791376250620130931150", "106024859502867110267419687826994238575", "209913841649926796741846809279602232275", "298090012230477056240749392424569058539", "146191834689988354582861061796100917605", "12102003753047298497756989403829790547", "288536425967749295275228198138937206395", "123259814890229235172367641832624658585", "313895290493904623434744421914978062168", "74413670498046396838933548594788388058", "208117407908900600207618631210575715878", "185314699748882036841895225554119519059"], "threshold":0.9}, "id":"ASB-A-466379326-fef522ed", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fa49f9f4ba37a8c65c27cc03ff1718abc6fc32b5", "target":{"file":"services/usb/java/com/android/server/usb/UsbService.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}