{"id":"ASB-A-471796626", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-11T15:42:03.104094163Z", "aliases":["CVE-2026-28634", "A-471796626"], "details":"In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/services/Telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/b76670f3c5ba3d8ad156de232aff09289fe49e26"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"222337894208834175636102186681021308661", "length":428}, "id":"ASB-A-471796626-22db06b9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/b76670f3c5ba3d8ad156de232aff09289fe49e26", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java", "function":"handleUssdRequest"}}, {"deprecated":false, "digest":{"line_hashes":["186919473631449760039227607004663883894", "114269787940673790174152819488750659068", "177151352633643644205142993540594464916"], "threshold":0.9}, "id":"ASB-A-471796626-86d2e6de", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/b76670f3c5ba3d8ad156de232aff09289fe49e26", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"}}]}}, {"package":{"name":"platform/packages/services/Telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/28ada8352466d0256eb243747db96f29ced9641f"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["186919473631449760039227607004663883894", "114269787940673790174152819488750659068", "177151352633643644205142993540594464916"], "threshold":0.9}, "id":"ASB-A-471796626-7e0a5b6f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/28ada8352466d0256eb243747db96f29ced9641f", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"}}, {"deprecated":false, "digest":{"function_hash":"222337894208834175636102186681021308661", "length":428}, "id":"ASB-A-471796626-8494315d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/28ada8352466d0256eb243747db96f29ced9641f", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java", "function":"handleUssdRequest"}}]}}, {"package":{"name":"platform/packages/services/Telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/5bbb1d01fff709247feb0ba009858b3f171eda33"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"222337894208834175636102186681021308661", "length":428}, "id":"ASB-A-471796626-be3516fe", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/5bbb1d01fff709247feb0ba009858b3f171eda33", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java", "function":"handleUssdRequest"}}, {"deprecated":false, "digest":{"line_hashes":["186919473631449760039227607004663883894", "114269787940673790174152819488750659068", "177151352633643644205142993540594464916"], "threshold":0.9}, "id":"ASB-A-471796626-d61f31c3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/5bbb1d01fff709247feb0ba009858b3f171eda33", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"}}]}}, {"package":{"name":"platform/packages/services/Telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/ef9e639eafb30559161b1a5856b1ff0217338373"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"222337894208834175636102186681021308661", "length":428}, "id":"ASB-A-471796626-6b82d4da", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/ef9e639eafb30559161b1a5856b1ff0217338373", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java", "function":"handleUssdRequest"}}, {"deprecated":false, "digest":{"line_hashes":["186919473631449760039227607004663883894", "114269787940673790174152819488750659068", "177151352633643644205142993540594464916"], "threshold":0.9}, "id":"ASB-A-471796626-afca8bd5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/ef9e639eafb30559161b1a5856b1ff0217338373", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"}}]}}, {"package":{"name":"platform/packages/services/Telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/1336ed741dc401c0d8992eaf7bdb2993e7980216"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"222337894208834175636102186681021308661", "length":428}, "id":"ASB-A-471796626-aef2114b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/1336ed741dc401c0d8992eaf7bdb2993e7980216", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java", "function":"handleUssdRequest"}}, {"deprecated":false, "digest":{"line_hashes":["186919473631449760039227607004663883894", "114269787940673790174152819488750659068", "177151352633643644205142993540594464916"], "threshold":0.9}, "id":"ASB-A-471796626-d9050b73", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/1336ed741dc401c0d8992eaf7bdb2993e7980216", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"}}]}}, {"package":{"name":"platform/packages/services/Telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telephony/+/863d637733d85660319688c88cca0c3513f432a9"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"305903702553705511918434832373802383297", "length":328}, "id":"ASB-A-471796626-6a70c3cc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/863d637733d85660319688c88cca0c3513f432a9", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java", "function":"handleUssdRequest"}}, {"deprecated":false, "digest":{"line_hashes":["128005657640396041656347709280993036307", "147241768871935847911590844890905890184", "290790585827739953921811939536942928386"], "threshold":0.9}, "id":"ASB-A-471796626-98f968f4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telephony/+/863d637733d85660319688c88cca0c3513f432a9", "target":{"file":"src/com/android/phone/PhoneInterfaceManager.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}