{"id":"ASB-A-478861451", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58970", "A-478861451"], "details":"In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/572a9e0a14c569535b351c314ddca9e45d0e635b"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"42545786270948247939115694997330856300", "length":587}, "id":"ASB-A-478861451-2b291160", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/572a9e0a14c569535b351c314ddca9e45d0e635b", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java", "function":"deliverResult"}}, {"deprecated":false, "digest":{"line_hashes":["95684936663425227581478169629733210733", "78271862597757234866865187883678106689", "86553225653796865187660634682691417360", "83045942880306541814562217583650842310", "115941277113593138183873853884904520287", "179216725968750459647782714189745461208"], "threshold":0.9}, "id":"ASB-A-478861451-5be02450", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/572a9e0a14c569535b351c314ddca9e45d0e635b", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d8c9f5c1764ffe5379784c5f81d20f127afeb971"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"42545786270948247939115694997330856300", "length":587}, "id":"ASB-A-478861451-549e2738", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d8c9f5c1764ffe5379784c5f81d20f127afeb971", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java", "function":"deliverResult"}}, {"deprecated":false, "digest":{"line_hashes":["95684936663425227581478169629733210733", "78271862597757234866865187883678106689", "86553225653796865187660634682691417360", "83045942880306541814562217583650842310", "115941277113593138183873853884904520287", "179216725968750459647782714189745461208"], "threshold":0.9}, "id":"ASB-A-478861451-bc84fa4c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d8c9f5c1764ffe5379784c5f81d20f127afeb971", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b4f296b6bdfc626f90c1dca4f1029f31eb48f8eb"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["95684936663425227581478169629733210733", "78271862597757234866865187883678106689", "86553225653796865187660634682691417360", "83045942880306541814562217583650842310", "115941277113593138183873853884904520287", "179216725968750459647782714189745461208"], "threshold":0.9}, "id":"ASB-A-478861451-4cf69313", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b4f296b6bdfc626f90c1dca4f1029f31eb48f8eb", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"}}, {"deprecated":false, "digest":{"function_hash":"42545786270948247939115694997330856300", "length":587}, "id":"ASB-A-478861451-999dbf73", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b4f296b6bdfc626f90c1dca4f1029f31eb48f8eb", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java", "function":"deliverResult"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8f46aae1853c0b9a5d5b2ae5b2c6547f9c45458e"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"42545786270948247939115694997330856300", "length":587}, "id":"ASB-A-478861451-1796b313", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8f46aae1853c0b9a5d5b2ae5b2c6547f9c45458e", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java", "function":"deliverResult"}}, {"deprecated":false, "digest":{"line_hashes":["95684936663425227581478169629733210733", "78271862597757234866865187883678106689", "86553225653796865187660634682691417360", "83045942880306541814562217583650842310", "115941277113593138183873853884904520287", "179216725968750459647782714189745461208"], "threshold":0.9}, "id":"ASB-A-478861451-8b1f36d2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8f46aae1853c0b9a5d5b2ae5b2c6547f9c45458e", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1049e39a373ba23ce55c697c8403f1978d5c0a4d"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["95684936663425227581478169629733210733", "78271862597757234866865187883678106689", "86553225653796865187660634682691417360", "83045942880306541814562217583650842310", "115941277113593138183873853884904520287", "179216725968750459647782714189745461208"], "threshold":0.9}, "id":"ASB-A-478861451-884a2726", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1049e39a373ba23ce55c697c8403f1978d5c0a4d", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"}}, {"deprecated":false, "digest":{"function_hash":"42545786270948247939115694997330856300", "length":587}, "id":"ASB-A-478861451-ace5bdae", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1049e39a373ba23ce55c697c8403f1978d5c0a4d", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java", "function":"deliverResult"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f06be8d7718d583029b5c8ff0e21a1ac94f8eb00"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"42545786270948247939115694997330856300", "length":587}, "id":"ASB-A-478861451-01a5f230", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f06be8d7718d583029b5c8ff0e21a1ac94f8eb00", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java", "function":"deliverResult"}}, {"deprecated":false, "digest":{"line_hashes":["95684936663425227581478169629733210733", "78271862597757234866865187883678106689", "86553225653796865187660634682691417360", "83045942880306541814562217583650842310", "115941277113593138183873853884904520287", "179216725968750459647782714189745461208"], "threshold":0.9}, "id":"ASB-A-478861451-891819bd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f06be8d7718d583029b5c8ff0e21a1ac94f8eb00", "target":{"file":"services/core/java/com/android/server/am/AppTimeTracker.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}