{"id":"ASB-A-472955222", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-55287", "A-472955222"], "details":"In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d143444ef510fb4520245a8cd69215278928fec5"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"153663437966185114295339081941073346834", "length":2878}, "id":"ASB-A-472955222-27e532ad", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d143444ef510fb4520245a8cd69215278928fec5", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["56645710521920417217373215438587051429", "277861099079550569511649178147717957547", "60674938557752733410102840961887676469", "272394306615921150029695408965310271939", "281860237435350437450720555391271101727", "8786521684922809620558730005483721972", "98670731487115345678371847976616895815", "57232722783176222636060877377538375563", "320000657993482607620528899390325086661", "246812040898514375762966373409745218984", "183805931470002077211658775864527861484", "272265180898521420405235250341236650246", "196421423597050888856838641919237543860", "319197744411632115068163722937333459282", "258945644126983863677322626628880495323"], "threshold":0.9}, "id":"ASB-A-472955222-3d264035", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d143444ef510fb4520245a8cd69215278928fec5", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"116376471945988316381732617952682591378", "length":148}, "id":"ASB-A-472955222-be9415ec", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d143444ef510fb4520245a8cd69215278928fec5", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"function_hash":"326428813048529110297114489865662366126", "length":423}, "id":"ASB-A-472955222-fb0b42d2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d143444ef510fb4520245a8cd69215278928fec5", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/43f99d7a38d642b8d9cc42482cfa4e52ec0b483f"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"116376471945988316381732617952682591378", "length":148}, "id":"ASB-A-472955222-7051f5c1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/43f99d7a38d642b8d9cc42482cfa4e52ec0b483f", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"function_hash":"326428813048529110297114489865662366126", "length":423}, "id":"ASB-A-472955222-aff3dfa8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/43f99d7a38d642b8d9cc42482cfa4e52ec0b483f", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"line_hashes":["212361821895359516917531625038063797602", "277861099079550569511649178147717957547", "60674938557752733410102840961887676469", "135469608184071623502761117812232678909", "281860237435350437450720555391271101727", "8786521684922809620558730005483721972", "98670731487115345678371847976616895815", "57232722783176222636060877377538375563", "320000657993482607620528899390325086661", "246812040898514375762966373409745218984", "183805931470002077211658775864527861484", "272265180898521420405235250341236650246", "196421423597050888856838641919237543860", "319197744411632115068163722937333459282", "258945644126983863677322626628880495323"], "threshold":0.9}, "id":"ASB-A-472955222-c17ebcd0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/43f99d7a38d642b8d9cc42482cfa4e52ec0b483f", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"197162200636670504925603515662748691600", "length":2537}, "id":"ASB-A-472955222-e44ccd95", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/43f99d7a38d642b8d9cc42482cfa4e52ec0b483f", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/322aa4e4de00d90b8de2821a32db15acfe599e61"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["212361821895359516917531625038063797602", "277861099079550569511649178147717957547", "60674938557752733410102840961887676469", "135469608184071623502761117812232678909", "281860237435350437450720555391271101727", "8786521684922809620558730005483721972", "98670731487115345678371847976616895815", "57232722783176222636060877377538375563", "320000657993482607620528899390325086661", "246812040898514375762966373409745218984", "183805931470002077211658775864527861484", "272265180898521420405235250341236650246", "196421423597050888856838641919237543860", "319197744411632115068163722937333459282", "258945644126983863677322626628880495323"], "threshold":0.9}, "id":"ASB-A-472955222-ca2efcab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/322aa4e4de00d90b8de2821a32db15acfe599e61", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"326428813048529110297114489865662366126", "length":423}, "id":"ASB-A-472955222-cf1a1e1a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/322aa4e4de00d90b8de2821a32db15acfe599e61", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"function_hash":"116376471945988316381732617952682591378", "length":148}, "id":"ASB-A-472955222-d0a1b909", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/322aa4e4de00d90b8de2821a32db15acfe599e61", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"function_hash":"197162200636670504925603515662748691600", "length":2537}, "id":"ASB-A-472955222-dbc62a91", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/322aa4e4de00d90b8de2821a32db15acfe599e61", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/595f4a42a90a0a5bfb7a903155c91cb3c355061e"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["212361821895359516917531625038063797602", "277861099079550569511649178147717957547", "60674938557752733410102840961887676469", "135469608184071623502761117812232678909", "281860237435350437450720555391271101727", "8786521684922809620558730005483721972", "98670731487115345678371847976616895815", "57232722783176222636060877377538375563", "320000657993482607620528899390325086661", "246812040898514375762966373409745218984", "183805931470002077211658775864527861484", "272265180898521420405235250341236650246", "196421423597050888856838641919237543860", "319197744411632115068163722937333459282", "258945644126983863677322626628880495323"], "threshold":0.9}, "id":"ASB-A-472955222-75f39d78", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/595f4a42a90a0a5bfb7a903155c91cb3c355061e", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"326428813048529110297114489865662366126", "length":423}, "id":"ASB-A-472955222-95203288", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/595f4a42a90a0a5bfb7a903155c91cb3c355061e", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"function_hash":"116376471945988316381732617952682591378", "length":148}, "id":"ASB-A-472955222-d13b6623", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/595f4a42a90a0a5bfb7a903155c91cb3c355061e", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"function_hash":"197162200636670504925603515662748691600", "length":2537}, "id":"ASB-A-472955222-e58cf07f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/595f4a42a90a0a5bfb7a903155c91cb3c355061e", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1fe77219000258a2dfccbf5eea25d1f1e9f334ea"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["212361821895359516917531625038063797602", "277861099079550569511649178147717957547", "60674938557752733410102840961887676469", "272394306615921150029695408965310271939", "281860237435350437450720555391271101727", "8786521684922809620558730005483721972", "98670731487115345678371847976616895815", "57232722783176222636060877377538375563", "320000657993482607620528899390325086661", "246812040898514375762966373409745218984", "183805931470002077211658775864527861484", "272265180898521420405235250341236650246", "196421423597050888856838641919237543860", "319197744411632115068163722937333459282", "258945644126983863677322626628880495323"], "threshold":0.9}, "id":"ASB-A-472955222-9a5af891", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1fe77219000258a2dfccbf5eea25d1f1e9f334ea", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"116376471945988316381732617952682591378", "length":148}, "id":"ASB-A-472955222-b0f0f3bf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1fe77219000258a2dfccbf5eea25d1f1e9f334ea", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"function_hash":"153663437966185114295339081941073346834", "length":2878}, "id":"ASB-A-472955222-cab78beb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1fe77219000258a2dfccbf5eea25d1f1e9f334ea", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"function_hash":"326428813048529110297114489865662366126", "length":423}, "id":"ASB-A-472955222-e2747fef", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1fe77219000258a2dfccbf5eea25d1f1e9f334ea", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7c68418af5d94e0097d45fc8f2745a24cc10c02c"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"116376471945988316381732617952682591378", "length":148}, "id":"ASB-A-472955222-1ea73f69", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7c68418af5d94e0097d45fc8f2745a24cc10c02c", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"line_hashes":["212361821895359516917531625038063797602", "277861099079550569511649178147717957547", "60674938557752733410102840961887676469", "135469608184071623502761117812232678909", "281860237435350437450720555391271101727", "8786521684922809620558730005483721972", "98670731487115345678371847976616895815", "57232722783176222636060877377538375563", "320000657993482607620528899390325086661", "246812040898514375762966373409745218984", "183805931470002077211658775864527861484", "272265180898521420405235250341236650246", "196421423597050888856838641919237543860", "319197744411632115068163722937333459282", "258945644126983863677322626628880495323"], "threshold":0.9}, "id":"ASB-A-472955222-72288b32", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7c68418af5d94e0097d45fc8f2745a24cc10c02c", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"326428813048529110297114489865662366126", "length":423}, "id":"ASB-A-472955222-b374312b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7c68418af5d94e0097d45fc8f2745a24cc10c02c", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"run"}}, {"deprecated":false, "digest":{"function_hash":"197162200636670504925603515662748691600", "length":2537}, "id":"ASB-A-472955222-d42fb5ad", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7c68418af5d94e0097d45fc8f2745a24cc10c02c", "target":{"file":"core/java/android/accounts/GrantCredentialsPermissionActivity.java", "function":"onCreate"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}