{"id":"ASB-A-470115162", "published":"2026-06-01T00:00:00Z", "modified":"2026-07-09T15:25:53.339171538Z", "aliases":["CVE-2026-0076", "A-470115162"], "details":"In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4d869cd4de74f1dccf30e729bd9caabc3b397e7a"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["238711144268367500787365508907809381479", "121433671173590328358289261807092112827", "251329274194203083262402745867686820167", "174148946231678814126456798966772071575"], "threshold":0.9}, "id":"ASB-A-470115162-339625e7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4d869cd4de74f1dccf30e729bd9caabc3b397e7a", "target":{"file":"libs/androidfw/ResourceTypes.cpp"}}, {"deprecated":false, "digest":{"function_hash":"17037310318613235027383153059887337164", "length":2522}, "id":"ASB-A-470115162-4669adee", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/4d869cd4de74f1dccf30e729bd9caabc3b397e7a", "target":{"file":"libs/androidfw/ResourceTypes.cpp", "function":"ResXMLTree::validateNode"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ca02a1c201d088a16f9bc59967dbe1e596950cff"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["238711144268367500787365508907809381479", "121433671173590328358289261807092112827", "251329274194203083262402745867686820167", "174148946231678814126456798966772071575"], "threshold":0.9}, "id":"ASB-A-470115162-1041b1d1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ca02a1c201d088a16f9bc59967dbe1e596950cff", "target":{"file":"libs/androidfw/ResourceTypes.cpp"}}, {"deprecated":false, "digest":{"function_hash":"17037310318613235027383153059887337164", "length":2522}, "id":"ASB-A-470115162-7457abee", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ca02a1c201d088a16f9bc59967dbe1e596950cff", "target":{"file":"libs/androidfw/ResourceTypes.cpp", "function":"ResXMLTree::validateNode"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/10ae6120c62d2eb4cb4ae3f3fc0484d6f594a141"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["238711144268367500787365508907809381479", "121433671173590328358289261807092112827", "251329274194203083262402745867686820167", "174148946231678814126456798966772071575"], "threshold":0.9}, "id":"ASB-A-470115162-2d473a60", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/10ae6120c62d2eb4cb4ae3f3fc0484d6f594a141", "target":{"file":"libs/androidfw/ResourceTypes.cpp"}}, {"deprecated":false, "digest":{"function_hash":"17037310318613235027383153059887337164", "length":2522}, "id":"ASB-A-470115162-e5519bf9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/10ae6120c62d2eb4cb4ae3f3fc0484d6f594a141", "target":{"file":"libs/androidfw/ResourceTypes.cpp", "function":"ResXMLTree::validateNode"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7f88e0521a216f1295446750d9461816eab37d87"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["238711144268367500787365508907809381479", "121433671173590328358289261807092112827", "251329274194203083262402745867686820167", "174148946231678814126456798966772071575"], "threshold":0.9}, "id":"ASB-A-470115162-30a772e7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7f88e0521a216f1295446750d9461816eab37d87", "target":{"file":"libs/androidfw/ResourceTypes.cpp"}}, {"deprecated":false, "digest":{"function_hash":"17037310318613235027383153059887337164", "length":2522}, "id":"ASB-A-470115162-c0ccaa80", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7f88e0521a216f1295446750d9461816eab37d87", "target":{"file":"libs/androidfw/ResourceTypes.cpp", "function":"ResXMLTree::validateNode"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9b483563ef746b2cfaf1d532b27d45d1be67931a"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["238711144268367500787365508907809381479", "121433671173590328358289261807092112827", "251329274194203083262402745867686820167", "174148946231678814126456798966772071575"], "threshold":0.9}, "id":"ASB-A-470115162-bcdb468f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9b483563ef746b2cfaf1d532b27d45d1be67931a", "target":{"file":"libs/androidfw/ResourceTypes.cpp"}}, {"deprecated":false, "digest":{"function_hash":"17037310318613235027383153059887337164", "length":2522}, "id":"ASB-A-470115162-e619502d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9b483563ef746b2cfaf1d532b27d45d1be67931a", "target":{"file":"libs/androidfw/ResourceTypes.cpp", "function":"ResXMLTree::validateNode"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/a91d16a02b51b7a5652031e485508eee655dff47"}]}