{"id":"ASB-A-475232460", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-28588", "A-475232460"], "details":"In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/effd5d3048ab0dc5ca5ec22fdf87e6a7685ca424"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"82275491147364504503650873122527320830", "length":501}, "id":"ASB-A-475232460-3ad065b1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/effd5d3048ab0dc5ca5ec22fdf87e6a7685ca424", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java", "function":"shouldBlockDirectoryFromTree"}}, {"deprecated":false, "digest":{"line_hashes":["83933681243297375959969558404587540873", "140183503849517433248087453465657570006", "224970194632832193963123257166118880462", "30244944761467983056972432635834368099", "83540861970962954288406580424248484276", "70837494746002368648737333109980752421", "208597600751418871290186384987124778971", "258002724981554527619314542337768977379"], "threshold":0.9}, "id":"ASB-A-475232460-93463e24", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/effd5d3048ab0dc5ca5ec22fdf87e6a7685ca424", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6855695cfc5fd08107c570c0cad696cfbb9ba288"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["329654153537445783966023628714573568130", "264252585570360469872925622770880012868", "307108107232959602058026563594635807119", "155279741308028289933410757958509439471", "297900573571846313474198597224233988480", "326469763656711846424129964613019927926", "232856273113549120966216948454444163978", "259347481328888458582651227720568894782", "83933681243297375959969558404587540873", "140183503849517433248087453465657570006", "224970194632832193963123257166118880462", "30244944761467983056972432635834368099", "83540861970962954288406580424248484276", "70837494746002368648737333109980752421", "208597600751418871290186384987124778971", "258002724981554527619314542337768977379", "50807490319445686384626557183339780000", "49715780295389434497044164315685455083"], "threshold":0.9}, "id":"ASB-A-475232460-9db9245c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6855695cfc5fd08107c570c0cad696cfbb9ba288", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"82275491147364504503650873122527320830", "length":501}, "id":"ASB-A-475232460-efaabc71", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6855695cfc5fd08107c570c0cad696cfbb9ba288", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java", "function":"shouldBlockDirectoryFromTree"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bc4fa785f51c7f450e30d54b75620aa252f9d3cc"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"82275491147364504503650873122527320830", "length":501}, "id":"ASB-A-475232460-1b5f102a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/bc4fa785f51c7f450e30d54b75620aa252f9d3cc", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java", "function":"shouldBlockDirectoryFromTree"}}, {"deprecated":false, "digest":{"line_hashes":["329654153537445783966023628714573568130", "264252585570360469872925622770880012868", "307108107232959602058026563594635807119", "155279741308028289933410757958509439471", "297900573571846313474198597224233988480", "326469763656711846424129964613019927926", "232856273113549120966216948454444163978", "259347481328888458582651227720568894782", "83933681243297375959969558404587540873", "140183503849517433248087453465657570006", "224970194632832193963123257166118880462", "30244944761467983056972432635834368099", "83540861970962954288406580424248484276", "70837494746002368648737333109980752421", "208597600751418871290186384987124778971", "258002724981554527619314542337768977379", "50807490319445686384626557183339780000", "49715780295389434497044164315685455083"], "threshold":0.9}, "id":"ASB-A-475232460-74cf9dba", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/bc4fa785f51c7f450e30d54b75620aa252f9d3cc", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5d3a4f9a23101a38191d288af00fe42d2df2d81e"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["329654153537445783966023628714573568130", "264252585570360469872925622770880012868", "307108107232959602058026563594635807119", "155279741308028289933410757958509439471", "297900573571846313474198597224233988480", "326469763656711846424129964613019927926", "232856273113549120966216948454444163978", "259347481328888458582651227720568894782", "83933681243297375959969558404587540873", "140183503849517433248087453465657570006", "224970194632832193963123257166118880462", "30244944761467983056972432635834368099", "83540861970962954288406580424248484276", "70837494746002368648737333109980752421", "208597600751418871290186384987124778971", "258002724981554527619314542337768977379", "50807490319445686384626557183339780000", "49715780295389434497044164315685455083"], "threshold":0.9}, "id":"ASB-A-475232460-4988cfbc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5d3a4f9a23101a38191d288af00fe42d2df2d81e", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"82275491147364504503650873122527320830", "length":501}, "id":"ASB-A-475232460-b6860dcc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5d3a4f9a23101a38191d288af00fe42d2df2d81e", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java", "function":"shouldBlockDirectoryFromTree"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e6443b622c9a3febfe166bc2094c8d98aeb037ee"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["329654153537445783966023628714573568130", "264252585570360469872925622770880012868", "307108107232959602058026563594635807119", "155279741308028289933410757958509439471", "297900573571846313474198597224233988480", "326469763656711846424129964613019927926", "232856273113549120966216948454444163978", "259347481328888458582651227720568894782", "83933681243297375959969558404587540873", "140183503849517433248087453465657570006", "224970194632832193963123257166118880462", "30244944761467983056972432635834368099", "83540861970962954288406580424248484276", "70837494746002368648737333109980752421", "208597600751418871290186384987124778971", "258002724981554527619314542337768977379", "262535813312078831260059445095950561145", "186209304742077193893622636900183857853"], "threshold":0.9}, "id":"ASB-A-475232460-436f7340", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e6443b622c9a3febfe166bc2094c8d98aeb037ee", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"}}, {"deprecated":false, "digest":{"function_hash":"82275491147364504503650873122527320830", "length":501}, "id":"ASB-A-475232460-8b3d71ed", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e6443b622c9a3febfe166bc2094c8d98aeb037ee", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java", "function":"shouldBlockDirectoryFromTree"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ec094886caf23a8d0495838ae67ab9616194c34b"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"82275491147364504503650873122527320830", "length":501}, "id":"ASB-A-475232460-9bb6f310", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ec094886caf23a8d0495838ae67ab9616194c34b", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java", "function":"shouldBlockDirectoryFromTree"}}, {"deprecated":false, "digest":{"line_hashes":["329654153537445783966023628714573568130", "264252585570360469872925622770880012868", "307108107232959602058026563594635807119", "155279741308028289933410757958509439471", "297900573571846313474198597224233988480", "326469763656711846424129964613019927926", "232856273113549120966216948454444163978", "259347481328888458582651227720568894782", "83933681243297375959969558404587540873", "140183503849517433248087453465657570006", "224970194632832193963123257166118880462", "30244944761467983056972432635834368099", "83540861970962954288406580424248484276", "70837494746002368648737333109980752421", "208597600751418871290186384987124778971", "258002724981554527619314542337768977379", "50807490319445686384626557183339780000", "49715780295389434497044164315685455083"], "threshold":0.9}, "id":"ASB-A-475232460-9d039527", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ec094886caf23a8d0495838ae67ab9616194c34b", "target":{"file":"packages/ExternalStorageProvider/src/com/android/externalstorage/ExternalStorageProvider.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}