{"id":"ASB-A-475542441", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28612", "A-475542441"], "details":"In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["80397874819914435962287995189429353279", "324869342438177983429542822815814803635", "33402783348378538749849599688089551584", "198819044329240885950294912553429500532", "77085443262448550127383596857662322331", "212192366188771760189339415757557208188", "53865122812802975109679423727452725434", "125981947974766921488540001279500083414", "201770805904630782353555982116669700691", "264599426912119222982544240821614659420", "189141642157816828296152565283176316292", "124537554651593874843128017938572052325", "7450090752167862960006447653757967239", "34927843616474237649522512679983462444", "57700655952896568908631876239598985640", "198015338095479692361873197064248404950"], "threshold":0.9}, "id":"ASB-A-475542441-4ca3caab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"}}, {"deprecated":false, "digest":{"function_hash":"152318689115643783965315851415430113549", "length":3806}, "id":"ASB-A-475542441-6bb1ab40", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveActivity"}}, {"deprecated":false, "digest":{"function_hash":"38071842428035955743637239282560935679", "length":4720}, "id":"ASB-A-475542441-75556df6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java", "function":"startActivities"}}, {"deprecated":false, "digest":{"line_hashes":["325917412571960559806126044957144615378", "253302707306192844154826311543182663588", "86405427633677763232192497837533324472", "189699288453370789495197806146032801016", "297518760508301895902510879832999055580", "337597234209694277940537694039608318580", "329389155866721868791704832052920768272", "282863183023824702358406795703522283096", "130130167180154615443060466846737541997", "211792142800539105703932329430569283144", "178266103278669671856588323618706586269", "295539928809912818928136327791533605105", "78582916131776485440030767200248866074", "189197256195804816283729717437234652939", "149268927962259120998306307305489256989", "113325408472494198665526707802296386374", "148164836224747363588314045789274849445", "324230526512426163353082979198179157586", "167372610395889717606324395043224027605", "37946721957814839870797236343900513553"], "threshold":0.9}, "id":"ASB-A-475542441-fc8d6842", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/93b9c2af63c6f161cd3287d27b892e0f2057c3ce", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"186982109334638526793663879095329947989", "length":3849}, "id":"ASB-A-475542441-1d14a9cc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveActivity"}}, {"deprecated":false, "digest":{"line_hashes":["325917412571960559806126044957144615378", "253302707306192844154826311543182663588", "86405427633677763232192497837533324472", "189699288453370789495197806146032801016", "297518760508301895902510879832999055580", "337597234209694277940537694039608318580", "329389155866721868791704832052920768272", "282863183023824702358406795703522283096", "130130167180154615443060466846737541997", "211792142800539105703932329430569283144", "178266103278669671856588323618706586269", "295539928809912818928136327791533605105", "78582916131776485440030767200248866074", "189197256195804816283729717437234652939", "149268927962259120998306307305489256989", "113325408472494198665526707802296386374", "148164836224747363588314045789274849445", "324230526512426163353082979198179157586", "167372610395889717606324395043224027605", "37946721957814839870797236343900513553"], "threshold":0.9}, "id":"ASB-A-475542441-47d54763", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"line_hashes":["80397874819914435962287995189429353279", "324869342438177983429542822815814803635", "33402783348378538749849599688089551584", "198819044329240885950294912553429500532", "77085443262448550127383596857662322331", "212192366188771760189339415757557208188", "53865122812802975109679423727452725434", "125981947974766921488540001279500083414", "201770805904630782353555982116669700691", "264599426912119222982544240821614659420", "189141642157816828296152565283176316292", "124537554651593874843128017938572052325", "7450090752167862960006447653757967239", "34927843616474237649522512679983462444", "57700655952896568908631876239598985640", "198015338095479692361873197064248404950"], "threshold":0.9}, "id":"ASB-A-475542441-e10a4a25", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"}}, {"deprecated":false, "digest":{"function_hash":"50496487256533071234918033827480579586", "length":4747}, "id":"ASB-A-475542441-f2b3c28a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/2006b1a874f6f6060a5f396d83ad827b13e78ca8", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java", "function":"startActivities"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"186982109334638526793663879095329947989", "length":3849}, "id":"ASB-A-475542441-52dce7e0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveActivity"}}, {"deprecated":false, "digest":{"line_hashes":["80397874819914435962287995189429353279", "324869342438177983429542822815814803635", "33402783348378538749849599688089551584", "198819044329240885950294912553429500532", "77085443262448550127383596857662322331", "212192366188771760189339415757557208188", "53865122812802975109679423727452725434", "125981947974766921488540001279500083414", "201770805904630782353555982116669700691", "264599426912119222982544240821614659420", "189141642157816828296152565283176316292", "124537554651593874843128017938572052325", "7450090752167862960006447653757967239", "34927843616474237649522512679983462444", "57700655952896568908631876239598985640", "198015338095479692361873197064248404950"], "threshold":0.9}, "id":"ASB-A-475542441-a4a0ead6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"}}, {"deprecated":false, "digest":{"line_hashes":["325917412571960559806126044957144615378", "253302707306192844154826311543182663588", "86405427633677763232192497837533324472", "189699288453370789495197806146032801016", "297518760508301895902510879832999055580", "337597234209694277940537694039608318580", "329389155866721868791704832052920768272", "282863183023824702358406795703522283096", "130130167180154615443060466846737541997", "211792142800539105703932329430569283144", "178266103278669671856588323618706586269", "295539928809912818928136327791533605105", "78582916131776485440030767200248866074", "189197256195804816283729717437234652939", "149268927962259120998306307305489256989", "113325408472494198665526707802296386374", "148164836224747363588314045789274849445", "324230526512426163353082979198179157586", "167372610395889717606324395043224027605", "37946721957814839870797236343900513553"], "threshold":0.9}, "id":"ASB-A-475542441-b1d48f17", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"50496487256533071234918033827480579586", "length":4747}, "id":"ASB-A-475542441-f6a0a54d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/183feb2444225d9ca215af78bb02bf7a4b26e475", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java", "function":"startActivities"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"38071842428035955743637239282560935679", "length":4720}, "id":"ASB-A-475542441-6865d39f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java", "function":"startActivities"}}, {"deprecated":false, "digest":{"function_hash":"152318689115643783965315851415430113549", "length":3806}, "id":"ASB-A-475542441-70cd8251", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveActivity"}}, {"deprecated":false, "digest":{"line_hashes":["325917412571960559806126044957144615378", "253302707306192844154826311543182663588", "86405427633677763232192497837533324472", "189699288453370789495197806146032801016", "297518760508301895902510879832999055580", "337597234209694277940537694039608318580", "329389155866721868791704832052920768272", "282863183023824702358406795703522283096", "130130167180154615443060466846737541997", "211792142800539105703932329430569283144", "178266103278669671856588323618706586269", "295539928809912818928136327791533605105", "78582916131776485440030767200248866074", "189197256195804816283729717437234652939", "149268927962259120998306307305489256989", "113325408472494198665526707802296386374", "148164836224747363588314045789274849445", "324230526512426163353082979198179157586", "167372610395889717606324395043224027605", "37946721957814839870797236343900513553"], "threshold":0.9}, "id":"ASB-A-475542441-cab10468", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"line_hashes":["80397874819914435962287995189429353279", "324869342438177983429542822815814803635", "33402783348378538749849599688089551584", "198819044329240885950294912553429500532", "77085443262448550127383596857662322331", "212192366188771760189339415757557208188", "53865122812802975109679423727452725434", "125981947974766921488540001279500083414", "201770805904630782353555982116669700691", "264599426912119222982544240821614659420", "189141642157816828296152565283176316292", "124537554651593874843128017938572052325", "7450090752167862960006447653757967239", "34927843616474237649522512679983462444", "57700655952896568908631876239598985640", "198015338095479692361873197064248404950"], "threshold":0.9}, "id":"ASB-A-475542441-ce023634", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/39d923cd458d175a237756e68f9781893cc3fc43", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}