{"id":"ASB-A-477935679", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-26T15:22:10.377767615Z", "aliases":["CVE-2026-28586", "A-477935679"], "details":"In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3b8d1a9f49543e8633f51e01488a40c927590764"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["330223784790800459396270580597842222247", "205497127833733297456001954393286670318", "76871089931511374015082060401648879418", "254521024448959936189427790976518843555", "321403588868251287444929487846006237288", "85510414880303899053404399250665269701", "321702195337119777782230869046854479801", "124076075376742486148626462857917617435", "203692094594859179449492540381006822053", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328", "201760475806120286497210186673097628914", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328", "203692094594859179449492540381006822053", "221875422627577698734141114737893829229", "246530168231413798872234245613118808268", "8885648149833179046045029243879889993"], "threshold":0.9}, "id":"ASB-A-477935679-445bf266", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b8d1a9f49543e8633f51e01488a40c927590764", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"}}, {"deprecated":false, "digest":{"function_hash":"20054042530425128116697124664489837497", "length":5238}, "id":"ASB-A-477935679-52cc8be1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b8d1a9f49543e8633f51e01488a40c927590764", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"noteOperationUnchecked"}}, {"deprecated":false, "digest":{"function_hash":"137300055972868490879914619948350433834", "length":4187}, "id":"ASB-A-477935679-5c078289", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b8d1a9f49543e8633f51e01488a40c927590764", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"startOperationUnchecked"}}, {"deprecated":false, "digest":{"function_hash":"149074983028962618029579885841036585085", "length":2995}, "id":"ASB-A-477935679-85e2e5aa", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3b8d1a9f49543e8633f51e01488a40c927590764", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"startOperationDryRun"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/379ebfa4e25eaa2b9ffab8a646db50a8adc3cd2b"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"76545377946378901160552319981495834728", "length":3906}, "id":"ASB-A-477935679-38a9d83d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/379ebfa4e25eaa2b9ffab8a646db50a8adc3cd2b", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"startOperationUnchecked"}}, {"deprecated":false, "digest":{"function_hash":"328030679335952060140103943926901869591", "length":4917}, "id":"ASB-A-477935679-7ef8a8c4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/379ebfa4e25eaa2b9ffab8a646db50a8adc3cd2b", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"noteOperationUnchecked"}}, {"deprecated":false, "digest":{"function_hash":"232978323490000553680144517882449373636", "length":2744}, "id":"ASB-A-477935679-f900cac0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/379ebfa4e25eaa2b9ffab8a646db50a8adc3cd2b", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"startOperationDryRun"}}, {"deprecated":false, "digest":{"line_hashes":["330223784790800459396270580597842222247", "205497127833733297456001954393286670318", "76871089931511374015082060401648879418", "254521024448959936189427790976518843555", "321403588868251287444929487846006237288", "85510414880303899053404399250665269701", "321702195337119777782230869046854479801", "124076075376742486148626462857917617435", "203692094594859179449492540381006822053", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328", "201760475806120286497210186673097628914", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328", "203692094594859179449492540381006822053", "15490112073715494497703134835590621815", "259243269073409252942904228957159482328", "75134671439508101352328536030028553666"], "threshold":0.9}, "id":"ASB-A-477935679-fefb994a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/379ebfa4e25eaa2b9ffab8a646db50a8adc3cd2b", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/eb1c8fbf88d489a3044ce5171264a52bc7d159f3"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["330223784790800459396270580597842222247", "205497127833733297456001954393286670318", "76871089931511374015082060401648879418", "254521024448959936189427790976518843555", "321403588868251287444929487846006237288", "85510414880303899053404399250665269701", "321702195337119777782230869046854479801", "124076075376742486148626462857917617435", "203692094594859179449492540381006822053", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328", "201760475806120286497210186673097628914", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328", "203692094594859179449492540381006822053", "15490112073715494497703134835590621815", "259243269073409252942904228957159482328", "75134671439508101352328536030028553666"], "threshold":0.9}, "id":"ASB-A-477935679-3a9e38ab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/eb1c8fbf88d489a3044ce5171264a52bc7d159f3", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"}}, {"deprecated":false, "digest":{"function_hash":"247671694764028345364292605032635504203", "length":2756}, "id":"ASB-A-477935679-413c6f31", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/eb1c8fbf88d489a3044ce5171264a52bc7d159f3", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"startOperationDryRun"}}, {"deprecated":false, "digest":{"function_hash":"14609156066317449805195125363508113733", "length":3940}, "id":"ASB-A-477935679-822d3c6b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/eb1c8fbf88d489a3044ce5171264a52bc7d159f3", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"startOperationUnchecked"}}, {"deprecated":false, "digest":{"function_hash":"284936445648432070658201968842008054750", "length":4975}, "id":"ASB-A-477935679-dcc70395", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/eb1c8fbf88d489a3044ce5171264a52bc7d159f3", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"noteOperationUnchecked"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a11bd07562598da6930d765cdcdef452e2cb4a15"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"157702728557543326051101909424278912053", "length":4999}, "id":"ASB-A-477935679-12fc57b8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a11bd07562598da6930d765cdcdef452e2cb4a15", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"noteOperationUnchecked"}}, {"deprecated":false, "digest":{"function_hash":"39835971086075113606379490378977839557", "length":3948}, "id":"ASB-A-477935679-37b0faf1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a11bd07562598da6930d765cdcdef452e2cb4a15", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"startOperationUnchecked"}}, {"deprecated":false, "digest":{"function_hash":"247671694764028345364292605032635504203", "length":2756}, "id":"ASB-A-477935679-66d3d288", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a11bd07562598da6930d765cdcdef452e2cb4a15", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"startOperationDryRun"}}, {"deprecated":false, "digest":{"line_hashes":["330223784790800459396270580597842222247", "205497127833733297456001954393286670318", "76871089931511374015082060401648879418", "254521024448959936189427790976518843555", "321403588868251287444929487846006237288", "85510414880303899053404399250665269701", "321702195337119777782230869046854479801", "124076075376742486148626462857917617435", "203692094594859179449492540381006822053", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328", "201760475806120286497210186673097628914", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328", "203692094594859179449492540381006822053", "15490112073715494497703134835590621815", "259243269073409252942904228957159482328", "75134671439508101352328536030028553666"], "threshold":0.9}, "id":"ASB-A-477935679-871eece0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a11bd07562598da6930d765cdcdef452e2cb4a15", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b08cc8a4ed6d364feb32340422fe6afe4df37859"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"3225596092993601395229141148856496114", "length":3855}, "id":"ASB-A-477935679-644d1bad", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b08cc8a4ed6d364feb32340422fe6afe4df37859", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"startOperationUnchecked"}}, {"deprecated":false, "digest":{"line_hashes":["91476076556625466715684806584164397093", "172783579519677709216001144974241369092", "55757666834536486742453314791235408386", "203692094594859179449492540381006822053", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328", "203692094594859179449492540381006822053", "323999317023626576731461233499595081369", "100578067320854990888030351572483960242", "309301345043340223503092460971582177328"], "threshold":0.9}, "id":"ASB-A-477935679-96aa1430", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b08cc8a4ed6d364feb32340422fe6afe4df37859", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"}}, {"deprecated":false, "digest":{"function_hash":"324883303349765496004482089336269505955", "length":3649}, "id":"ASB-A-477935679-c20b2d4c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b08cc8a4ed6d364feb32340422fe6afe4df37859", "target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java", "function":"noteOperationUnchecked"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/9bef8bf1eee45a434e10c40e61acaeb2f90e10ad"}]}