{"id":"ASB-A-471796999", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-11T15:42:03.104094163Z", "aliases":["CVE-2026-45517", "A-471796999"], "details":"In screenArgsForPermissionCheckIfAny of MediaQueryForPreSelection.java, there is a possible way to access the images of other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["136255459881779733209561662218611934790", "294395367568580721154358350653390701654", "46704886324711199053884571002473274369", "92280561204726612164917428532911013178", "149488789888522109969672204370976144719", "123714394082864184769197045713019983691", "108398568806677337986889258313593990368", "115530110639175773067896047472828955136", "12969490581236637703291539309192293506", "148860207675838887737732496377067494087", "59787260834000109755073587214637676915", "250927025799556404337369632780213672380", "153232267534240168716064683100508580486", "231568951080580047518794930010030619265", "268626125767758347402833061940876956583", "13609415844016869391950478574051330686"], "threshold":0.9}, "id":"ASB-A-471796999-404cf08e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java"}}, {"deprecated":false, "digest":{"function_hash":"264559702129777484324328993580616315011", "length":590}, "id":"ASB-A-471796999-71dbd3c6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985", "target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java", "function":"screenArgsForPermissionCheckIfAny"}}, {"deprecated":false, "digest":{"line_hashes":["19924643050850108401883855550262439785", "170159817407103117438102879015631521666", "118460369435563544126036271063373873364", "194180163168415881859395927773523052515", "92280561204726612164917428532911013178", "149488789888522109969672204370976144719", "123714394082864184769197045713019983691", "281803136071988038811810038568288392263", "169354623858565396753326218815789051880", "277072968968551115521142189214644226443"], "threshold":0.9}, "id":"ASB-A-471796999-c47e7506", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985", "target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"}}, {"deprecated":false, "digest":{"function_hash":"314392134150603790358806780874580300956", "length":591}, "id":"ASB-A-471796999-e429ab16", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/66e7be95b21e27a7ac3dc12c0b618a61a48d8985", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java", "function":"screenArgsForPermissionCheckIfAny"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c9f7b2e3b05f3bfc64d1175abf410f4f9358a6ba"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["195624920530932057258581649471710216073", "258434652752132456608038097898545695380", "280545441745195443108241071443220242792", "203416457843596201237539545775347676538", "136255459881779733209561662218611934790", "294395367568580721154358350653390701654", "46704886324711199053884571002473274369", "92280561204726612164917428532911013178", "149488789888522109969672204370976144719", "123714394082864184769197045713019983691", "108398568806677337986889258313593990368", "115530110639175773067896047472828955136", "12969490581236637703291539309192293506", "242064081025345028933814232958041951599", "106365547840900362436021187747521175083", "293265090967399996607092831297516822386"], "threshold":0.9}, "id":"ASB-A-471796999-7b2b9d27", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c9f7b2e3b05f3bfc64d1175abf410f4f9358a6ba", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java"}}, {"deprecated":false, "digest":{"function_hash":"314392134150603790358806780874580300956", "length":591}, "id":"ASB-A-471796999-945bc965", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/c9f7b2e3b05f3bfc64d1175abf410f4f9358a6ba", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java", "function":"screenArgsForPermissionCheckIfAny"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["19924643050850108401883855550262439785", "170159817407103117438102879015631521666", "118460369435563544126036271063373873364", "194180163168415881859395927773523052515", "92280561204726612164917428532911013178", "149488789888522109969672204370976144719", "123714394082864184769197045713019983691", "281803136071988038811810038568288392263", "169354623858565396753326218815789051880", "277072968968551115521142189214644226443"], "threshold":0.9}, "id":"ASB-A-471796999-09fe82c2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b", "target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"}}, {"deprecated":false, "digest":{"function_hash":"314392134150603790358806780874580300956", "length":591}, "id":"ASB-A-471796999-5bec9ff1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java", "function":"screenArgsForPermissionCheckIfAny"}}, {"deprecated":false, "digest":{"line_hashes":["136255459881779733209561662218611934790", "294395367568580721154358350653390701654", "46704886324711199053884571002473274369", "92280561204726612164917428532911013178", "149488789888522109969672204370976144719", "123714394082864184769197045713019983691", "108398568806677337986889258313593990368", "115530110639175773067896047472828955136", "12969490581236637703291539309192293506", "148860207675838887737732496377067494087", "59787260834000109755073587214637676915", "250927025799556404337369632780213672380", "153232267534240168716064683100508580486", "231568951080580047518794930010030619265", "268626125767758347402833061940876956583", "13609415844016869391950478574051330686"], "threshold":0.9}, "id":"ASB-A-471796999-73e21438", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java"}}, {"deprecated":false, "digest":{"function_hash":"264559702129777484324328993580616315011", "length":590}, "id":"ASB-A-471796999-c17f819a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/58cd3163420af00a32d1354bf38dc359c0fc8a1b", "target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java", "function":"screenArgsForPermissionCheckIfAny"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["136255459881779733209561662218611934790", "294395367568580721154358350653390701654", "46704886324711199053884571002473274369", "92280561204726612164917428532911013178", "149488789888522109969672204370976144719", "123714394082864184769197045713019983691", "108398568806677337986889258313593990368", "115530110639175773067896047472828955136", "12969490581236637703291539309192293506", "148860207675838887737732496377067494087", "59787260834000109755073587214637676915", "250927025799556404337369632780213672380", "153232267534240168716064683100508580486", "231568951080580047518794930010030619265", "268626125767758347402833061940876956583", "13609415844016869391950478574051330686"], "threshold":0.9}, "id":"ASB-A-471796999-7e7d6514", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java"}}, {"deprecated":false, "digest":{"function_hash":"314392134150603790358806780874580300956", "length":591}, "id":"ASB-A-471796999-90d4e6eb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java", "function":"screenArgsForPermissionCheckIfAny"}}, {"deprecated":false, "digest":{"line_hashes":["19924643050850108401883855550262439785", "170159817407103117438102879015631521666", "118460369435563544126036271063373873364", "194180163168415881859395927773523052515", "92280561204726612164917428532911013178", "149488789888522109969672204370976144719", "123714394082864184769197045713019983691", "281803136071988038811810038568288392263", "169354623858565396753326218815789051880", "277072968968551115521142189214644226443"], "threshold":0.9}, "id":"ASB-A-471796999-c252da75", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9", "target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"}}, {"deprecated":false, "digest":{"function_hash":"264559702129777484324328993580616315011", "length":590}, "id":"ASB-A-471796999-d1782182", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/bedcb3c218ed586a51b22424578b7f1369746bd9", "target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java", "function":"screenArgsForPermissionCheckIfAny"}}]}}, {"package":{"name":"platform/packages/providers/MediaProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"264559702129777484324328993580616315011", "length":590}, "id":"ASB-A-471796999-21f9e8ea", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c", "target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java", "function":"screenArgsForPermissionCheckIfAny"}}, {"deprecated":false, "digest":{"line_hashes":["19924643050850108401883855550262439785", "170159817407103117438102879015631521666", "118460369435563544126036271063373873364", "194180163168415881859395927773523052515", "92280561204726612164917428532911013178", "149488789888522109969672204370976144719", "123714394082864184769197045713019983691", "281803136071988038811810038568288392263", "169354623858565396753326218815789051880", "277072968968551115521142189214644226443"], "threshold":0.9}, "id":"ASB-A-471796999-3b6b2c21", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c", "target":{"file":"src/com/android/providers/media/photopicker/v2/model/MediaQueryForPreSelection.java"}}, {"deprecated":false, "digest":{"function_hash":"314392134150603790358806780874580300956", "length":591}, "id":"ASB-A-471796999-829b9d05", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java", "function":"screenArgsForPermissionCheckIfAny"}}, {"deprecated":false, "digest":{"line_hashes":["136255459881779733209561662218611934790", "294395367568580721154358350653390701654", "46704886324711199053884571002473274369", "92280561204726612164917428532911013178", "149488789888522109969672204370976144719", "123714394082864184769197045713019983691", "108398568806677337986889258313593990368", "115530110639175773067896047472828955136", "12969490581236637703291539309192293506", "148860207675838887737732496377067494087", "59787260834000109755073587214637676915", "250927025799556404337369632780213672380", "153232267534240168716064683100508580486", "231568951080580047518794930010030619265", "268626125767758347402833061940876956583", "13609415844016869391950478574051330686"], "threshold":0.9}, "id":"ASB-A-471796999-996c5382", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/MediaProvider/+/b590a2de0de314c65a978c6ea819876b2384b12c", "target":{"file":"src/com/android/providers/media/PickerUriResolver.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}