{"id":"ASB-A-473814675", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-0084", "A-473814675"], "details":"In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"307306498109203122948322537838215800761", "length":713}, "id":"ASB-A-473814675-1cf865c9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"unbindServiceIfNeededLocked"}}, {"deprecated":false, "digest":{"line_hashes":["32916723925632318774299212725510119998", "23465703901109145808070033521243449922", "27074621150207393466112425325617462379", "278192926761753424587106581378240049629", "94191613873949150973081755475584323077", "173068256567675514713721637381528454459", "256067101529890981159102112154481844784", "266006951096580694214259099408002940696", "205033917680389892942356032010261995008", "180242617872509661209655221367717215698", "154558351122561472081162410037952380884", "52637053039034779991475866448153655851", "48750494594910239388672805466368974054", "95332332791951369099579818254854543664", "54641944154349474374140373142669916394", "213408842048918346247549120204071575202", "236629189440246271617986640990559865774", "139388628554035034461246132277920728899", "177674149891137280774393486567163277463", "20209024432163955890111178053820901147", "92210813461598043500546680177868128967", "324796329057189940513036913132971346812", "122655996882589398941049316572214181585", "44034718097019716667676964917304335937", "217440627658852519073481743159565701711", "23437164819922502552514580924002030427", "97296571701981812174850137143837846234", "302463261408426082452619241468575048348", "284901402231722898802864401025636069074", "77451213172031023835549673663606374291", "30837802114692911668435351510048138437", "329846614121192265050548696624380154529", "75359969764965975072068991768790728022", "258864385201942430195220001622672889735", "103239287560605372200313922842440123325", "88384007256271835668450122460948718419", "155595283141879195238343321405519120733", "54216206314338370435003253701142911133", "12158097515406970619246323944090638097", "179936530091154085180439514123287570670", "183664819523193451429488277827647457664", "65041775798212110474632731902588482060", "77049163206267300173859525311079167067", "160366424869744482228520351923117736751", "121403439584687912447768080149365310609", "146980110866547170052715400937635311602", "106389199246654423351681598392121197241", "299274195767484732676569315662222910418"], "threshold":0.9}, "id":"ASB-A-473814675-6258603b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"}}, {"deprecated":false, "digest":{"function_hash":"305091786940368283214673959004810110189", "length":102}, "id":"ASB-A-473814675-66aa4e9e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"onBindingDied"}}, {"deprecated":false, "digest":{"function_hash":"199352943883854230378010914782653536497", "length":678}, "id":"ASB-A-473814675-87e74a2a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"unbindInactiveServicesLocked"}}, {"deprecated":false, "digest":{"function_hash":"256090902513176896471564293279583413352", "length":473}, "id":"ASB-A-473814675-e10db742", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/2711c9ef108434aa87e92a3de1e1b439f8d07c4f", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"onPreferredForegroundServiceChanged"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb", "https://android.googlesource.com/platform/packages/modules/Nfc/+/f6fc44fac696ab4ef6d148986443b9a47afc78a2", "https://android.googlesource.com/platform/packages/modules/Nfc/+/44f9a3b107be2185f366e85ef0215606e3b57f16"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"305091786940368283214673959004810110189", "length":102}, "id":"ASB-A-473814675-26655b0d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/44f9a3b107be2185f366e85ef0215606e3b57f16", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"onBindingDied"}}, {"deprecated":false, "digest":{"function_hash":"199352943883854230378010914782653536497", "length":678}, "id":"ASB-A-473814675-5b24d15b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"unbindInactiveServicesLocked"}}, {"deprecated":false, "digest":{"function_hash":"307306498109203122948322537838215800761", "length":713}, "id":"ASB-A-473814675-61ce63c3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"unbindServiceIfNeededLocked"}}, {"deprecated":false, "digest":{"line_hashes":["121403439584687912447768080149365310609", "146980110866547170052715400937635311602", "106389199246654423351681598392121197241", "299274195767484732676569315662222910418"], "threshold":0.9}, "id":"ASB-A-473814675-9beaf865", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/44f9a3b107be2185f366e85ef0215606e3b57f16", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"}}, {"deprecated":false, "digest":{"line_hashes":["50428217262205589717793303943962234049", "283809765770388058340367956760258520701", "15334545613834930763439853215230945047", "278192926761753424587106581378240049629", "94191613873949150973081755475584323077", "173068256567675514713721637381528454459", "256067101529890981159102112154481844784", "266006951096580694214259099408002940696", "205033917680389892942356032010261995008", "180242617872509661209655221367717215698", "154558351122561472081162410037952380884", "52637053039034779991475866448153655851", "48750494594910239388672805466368974054", "95332332791951369099579818254854543664", "54641944154349474374140373142669916394", "213408842048918346247549120204071575202", "236629189440246271617986640990559865774", "139388628554035034461246132277920728899", "177674149891137280774393486567163277463", "20209024432163955890111178053820901147", "92210813461598043500546680177868128967", "324796329057189940513036913132971346812", "122655996882589398941049316572214181585", "44034718097019716667676964917304335937", "217440627658852519073481743159565701711", "23437164819922502552514580924002030427", "97296571701981812174850137143837846234", "302463261408426082452619241468575048348", "284901402231722898802864401025636069074", "77451213172031023835549673663606374291", "30837802114692911668435351510048138437", "329846614121192265050548696624380154529", "75359969764965975072068991768790728022", "258864385201942430195220001622672889735", "103239287560605372200313922842440123325", "88384007256271835668450122460948718419", "155595283141879195238343321405519120733", "54216206314338370435003253701142911133", "12158097515406970619246323944090638097", "179936530091154085180439514123287570670", "183664819523193451429488277827647457664", "65041775798212110474632731902588482060", "77049163206267300173859525311079167067", "160366424869744482228520351923117736751"], "threshold":0.9}, "id":"ASB-A-473814675-e2cd71ce", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"}}, {"deprecated":false, "digest":{"function_hash":"150071831528752995632003707593280758522", "length":368}, "id":"ASB-A-473814675-f96b9b73", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/f75f66e6f992e28fed5e4ed4e799e3f3a243b3fb", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"onPreferredForegroundServiceChanged"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6", "https://android.googlesource.com/platform/packages/modules/Nfc/+/2d4b7ed433917f2146cbb1043b739eb8f96c0f09", "https://android.googlesource.com/platform/packages/modules/Nfc/+/238fdb247a8d5ea75638e5b90a9ef3ef481f26e6"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"305091786940368283214673959004810110189", "length":102}, "id":"ASB-A-473814675-253bf072", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/238fdb247a8d5ea75638e5b90a9ef3ef481f26e6", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"onBindingDied"}}, {"deprecated":false, "digest":{"function_hash":"256090902513176896471564293279583413352", "length":473}, "id":"ASB-A-473814675-29331a15", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"onPreferredForegroundServiceChanged"}}, {"deprecated":false, "digest":{"function_hash":"199352943883854230378010914782653536497", "length":678}, "id":"ASB-A-473814675-32c1535f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"unbindInactiveServicesLocked"}}, {"deprecated":false, "digest":{"function_hash":"307306498109203122948322537838215800761", "length":713}, "id":"ASB-A-473814675-3ce2f0fa", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"unbindServiceIfNeededLocked"}}, {"deprecated":false, "digest":{"line_hashes":["121403439584687912447768080149365310609", "146980110866547170052715400937635311602", "106389199246654423351681598392121197241", "299274195767484732676569315662222910418"], "threshold":0.9}, "id":"ASB-A-473814675-978be848", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/238fdb247a8d5ea75638e5b90a9ef3ef481f26e6", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"}}, {"deprecated":false, "digest":{"line_hashes":["32916723925632318774299212725510119998", "23465703901109145808070033521243449922", "27074621150207393466112425325617462379", "278192926761753424587106581378240049629", "94191613873949150973081755475584323077", "173068256567675514713721637381528454459", "256067101529890981159102112154481844784", "266006951096580694214259099408002940696", "205033917680389892942356032010261995008", "180242617872509661209655221367717215698", "154558351122561472081162410037952380884", "52637053039034779991475866448153655851", "48750494594910239388672805466368974054", "95332332791951369099579818254854543664", "54641944154349474374140373142669916394", "213408842048918346247549120204071575202", "236629189440246271617986640990559865774", "139388628554035034461246132277920728899", "177674149891137280774393486567163277463", "20209024432163955890111178053820901147", "92210813461598043500546680177868128967", "324796329057189940513036913132971346812", "122655996882589398941049316572214181585", "44034718097019716667676964917304335937", "217440627658852519073481743159565701711", "23437164819922502552514580924002030427", "97296571701981812174850137143837846234", "302463261408426082452619241468575048348", "284901402231722898802864401025636069074", "77451213172031023835549673663606374291", "30837802114692911668435351510048138437", "329846614121192265050548696624380154529", "75359969764965975072068991768790728022", "258864385201942430195220001622672889735", "103239287560605372200313922842440123325", "88384007256271835668450122460948718419", "155595283141879195238343321405519120733", "54216206314338370435003253701142911133", "12158097515406970619246323944090638097", "179936530091154085180439514123287570670", "183664819523193451429488277827647457664", "65041775798212110474632731902588482060", "77049163206267300173859525311079167067", "160366424869744482228520351923117736751"], "threshold":0.9}, "id":"ASB-A-473814675-9df2303e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6bd2c7099890fb612a817ca168a1ce0d347698e6", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}