{"id":"ASB-A-477024345", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28620", "A-477024345"], "details":"In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"152318689115643783965315851415430113549", "length":3806}, "id":"ASB-A-477024345-32655172", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveActivity"}}, {"deprecated":false, "digest":{"line_hashes":["311931675790667359574614959848407815702", "163252509079289346664598790677778443218", "81385348547056583696103598749518187225", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "37670851724393402769987267860672672230"], "threshold":0.9}, "id":"ASB-A-477024345-3ed1f3e9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"}}, {"deprecated":false, "digest":{"line_hashes":["35569745026013085848239426614272421549", "173256776503252644784681834994761176508", "194188360801631649423941407410132786513", "248475251836087992390790924110843801200", "112910424240242112564828443782631983980", "44472087015759157047368738032372413949", "118605152507255773949623267589271039415", "186329621376257576555161691475201072784", "64411954336128645573010321346078750655", "147890503543006373049841438025174675528", "270873643634567871409597883676451149861", "335972251913161175978062125401849251240", "26222936968821393451451797395371633530", "103776494053485082044950756777474764424", "293765116076340145545323415283053483909", "328829695709924917487563941793712321161"], "threshold":0.9}, "id":"ASB-A-477024345-4622895e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0", "target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java"}}, {"deprecated":false, "digest":{"function_hash":"38071842428035955743637239282560935679", "length":4720}, "id":"ASB-A-477024345-5bf69e4b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java", "function":"startActivities"}}, {"deprecated":false, "digest":{"function_hash":"89348211610579307423791110472317762373", "length":542}, "id":"ASB-A-477024345-a5fe7318", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0", "target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java", "function":"merge"}}, {"deprecated":false, "digest":{"line_hashes":["125269627930518898555081884368879613133", "178224263307165794426840339082286572912", "313681859873681975699662879793020049486", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "129048391759178933727709666415787659955", "51404594350926397848415728400378119354", "56951790898355548827536525945965240160", "47308593454506064418212278157537728877", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "129048391759178933727709666415787659955"], "threshold":0.9}, "id":"ASB-A-477024345-fa805f75", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/73db64658dd35ab3ef781fc73983f1ee694111f0", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"283223847655597982080293287674541690965", "length":3849}, "id":"ASB-A-477024345-14c31a31", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveActivity"}}, {"deprecated":false, "digest":{"function_hash":"5778001945956117264740357899042616041", "length":5109}, "id":"ASB-A-477024345-1e52693b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java", "function":"startActivities"}}, {"deprecated":false, "digest":{"line_hashes":["204079113822947347771730577170556123068", "172530096293394197421915780989262411", "195951391941049641906592842730310883678", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "37670851724393402769987267860672672230"], "threshold":0.9}, "id":"ASB-A-477024345-2dd99732", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"}}, {"deprecated":false, "digest":{"line_hashes":["35569745026013085848239426614272421549", "173256776503252644784681834994761176508", "194188360801631649423941407410132786513", "248475251836087992390790924110843801200", "112910424240242112564828443782631983980", "44472087015759157047368738032372413949", "118605152507255773949623267589271039415", "186329621376257576555161691475201072784", "64411954336128645573010321346078750655", "147890503543006373049841438025174675528", "270873643634567871409597883676451149861", "335972251913161175978062125401849251240", "26222936968821393451451797395371633530", "103776494053485082044950756777474764424", "293765116076340145545323415283053483909", "328829695709924917487563941793712321161"], "threshold":0.9}, "id":"ASB-A-477024345-30a2c6f0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09", "target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java"}}, {"deprecated":false, "digest":{"function_hash":"89348211610579307423791110472317762373", "length":542}, "id":"ASB-A-477024345-5151c8f8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09", "target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java", "function":"merge"}}, {"deprecated":false, "digest":{"line_hashes":["338725473824679195199727831045888689853", "178224263307165794426840339082286572912", "313681859873681975699662879793020049486", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "129048391759178933727709666415787659955", "12154416197711547475059348709956217156", "218629848199710159601992890428026474254", "44625833088130840786537487043808975684", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "129048391759178933727709666415787659955"], "threshold":0.9}, "id":"ASB-A-477024345-860651a3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d54ada91abc5b9c0537d8fbce77600de22496f09", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"283223847655597982080293287674541690965", "length":3849}, "id":"ASB-A-477024345-18621891", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveActivity"}}, {"deprecated":false, "digest":{"function_hash":"89348211610579307423791110472317762373", "length":542}, "id":"ASB-A-477024345-6f04c271", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f", "target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java", "function":"merge"}}, {"deprecated":false, "digest":{"line_hashes":["35569745026013085848239426614272421549", "173256776503252644784681834994761176508", "194188360801631649423941407410132786513", "248475251836087992390790924110843801200", "112910424240242112564828443782631983980", "44472087015759157047368738032372413949", "118605152507255773949623267589271039415", "186329621376257576555161691475201072784", "64411954336128645573010321346078750655", "147890503543006373049841438025174675528", "270873643634567871409597883676451149861", "335972251913161175978062125401849251240", "26222936968821393451451797395371633530", "103776494053485082044950756777474764424", "293765116076340145545323415283053483909", "328829695709924917487563941793712321161"], "threshold":0.9}, "id":"ASB-A-477024345-7017f3d5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f", "target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java"}}, {"deprecated":false, "digest":{"function_hash":"5778001945956117264740357899042616041", "length":5109}, "id":"ASB-A-477024345-793be8d3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java", "function":"startActivities"}}, {"deprecated":false, "digest":{"line_hashes":["204079113822947347771730577170556123068", "172530096293394197421915780989262411", "195951391941049641906592842730310883678", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "37670851724393402769987267860672672230"], "threshold":0.9}, "id":"ASB-A-477024345-cba76085", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"}}, {"deprecated":false, "digest":{"line_hashes":["338725473824679195199727831045888689853", "178224263307165794426840339082286572912", "313681859873681975699662879793020049486", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "129048391759178933727709666415787659955", "12154416197711547475059348709956217156", "218629848199710159601992890428026474254", "44625833088130840786537487043808975684", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "129048391759178933727709666415787659955"], "threshold":0.9}, "id":"ASB-A-477024345-cd089d41", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e4f649fe390f4cac6c7f65265af3bc8c97af5f1f", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["35569745026013085848239426614272421549", "173256776503252644784681834994761176508", "194188360801631649423941407410132786513", "248475251836087992390790924110843801200", "112910424240242112564828443782631983980", "44472087015759157047368738032372413949", "118605152507255773949623267589271039415", "186329621376257576555161691475201072784", "64411954336128645573010321346078750655", "147890503543006373049841438025174675528", "270873643634567871409597883676451149861", "335972251913161175978062125401849251240", "26222936968821393451451797395371633530", "103776494053485082044950756777474764424", "293765116076340145545323415283053483909", "328829695709924917487563941793712321161"], "threshold":0.9}, "id":"ASB-A-477024345-030acc9d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c", "target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java"}}, {"deprecated":false, "digest":{"function_hash":"89348211610579307423791110472317762373", "length":542}, "id":"ASB-A-477024345-3e8c103c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c", "target":{"file":"services/core/java/com/android/server/uri/NeededUriGrants.java", "function":"merge"}}, {"deprecated":false, "digest":{"line_hashes":["125269627930518898555081884368879613133", "178224263307165794426840339082286572912", "313681859873681975699662879793020049486", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "129048391759178933727709666415787659955", "51404594350926397848415728400378119354", "56951790898355548827536525945965240160", "47308593454506064418212278157537728877", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "129048391759178933727709666415787659955"], "threshold":0.9}, "id":"ASB-A-477024345-509c4d4a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"38071842428035955743637239282560935679", "length":4720}, "id":"ASB-A-477024345-70f6eb42", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java", "function":"startActivities"}}, {"deprecated":false, "digest":{"line_hashes":["311931675790667359574614959848407815702", "163252509079289346664598790677778443218", "81385348547056583696103598749518187225", "153284084378809162492688464036135396280", "217949069136231241119266033625709029021", "276242586268243559182812891332093382542", "37670851724393402769987267860672672230"], "threshold":0.9}, "id":"ASB-A-477024345-b80faff8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c", "target":{"file":"services/core/java/com/android/server/wm/ActivityStartController.java"}}, {"deprecated":false, "digest":{"function_hash":"152318689115643783965315851415430113549", "length":3806}, "id":"ASB-A-477024345-c2ad4e6f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0160b0a69e16852212b2cf19111d998781982e7c", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveActivity"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}