{"id":"ASB-A-486385459", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28614", "A-486385459"], "details":"In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7f44449562bc0a09e52ec84b37d95733c823e72d"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["228640235943044697760860749741364190128", "43953125796183454816142807662472777682", "58952132057675723472071783682177358395", "269123462518549626182616420424445080976", "10628864266787156032942855332068102196", "288353105007237176253432773326204834254", "179265687405319244813021154584500733258"], "threshold":0.9}, "id":"ASB-A-486385459-a540a588", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7f44449562bc0a09e52ec84b37d95733c823e72d", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"284230453840811548508644633072343656261", "length":2312}, "id":"ASB-A-486385459-c585a860", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7f44449562bc0a09e52ec84b37d95733c823e72d", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/90e563165474eb865ba3aecd54e71a0c445966c0"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"284230453840811548508644633072343656261", "length":2312}, "id":"ASB-A-486385459-ccc4df23", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/90e563165474eb865ba3aecd54e71a0c445966c0", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["228640235943044697760860749741364190128", "43953125796183454816142807662472777682", "58952132057675723472071783682177358395", "269123462518549626182616420424445080976", "10628864266787156032942855332068102196", "288353105007237176253432773326204834254", "179265687405319244813021154584500733258"], "threshold":0.9}, "id":"ASB-A-486385459-ee500ad0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/90e563165474eb865ba3aecd54e71a0c445966c0", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/390eefdff00b5ec4ecd669dfcd975b82f772e6df"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["228640235943044697760860749741364190128", "43953125796183454816142807662472777682", "58952132057675723472071783682177358395", "269123462518549626182616420424445080976", "10628864266787156032942855332068102196", "288353105007237176253432773326204834254", "179265687405319244813021154584500733258"], "threshold":0.9}, "id":"ASB-A-486385459-13917c82", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/390eefdff00b5ec4ecd669dfcd975b82f772e6df", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"284230453840811548508644633072343656261", "length":2312}, "id":"ASB-A-486385459-a81a87a2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/390eefdff00b5ec4ecd669dfcd975b82f772e6df", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/216464c8bcb7a2f60604cc6fd0f968639f5e891f"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["228640235943044697760860749741364190128", "43953125796183454816142807662472777682", "58952132057675723472071783682177358395", "269123462518549626182616420424445080976", "10628864266787156032942855332068102196", "288353105007237176253432773326204834254", "179265687405319244813021154584500733258"], "threshold":0.9}, "id":"ASB-A-486385459-1ecfef58", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/216464c8bcb7a2f60604cc6fd0f968639f5e891f", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"284230453840811548508644633072343656261", "length":2312}, "id":"ASB-A-486385459-d67c24a1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/216464c8bcb7a2f60604cc6fd0f968639f5e891f", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dbcba0975474be9589ee5ed4b809b5eb052e6468"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["228640235943044697760860749741364190128", "43953125796183454816142807662472777682", "58952132057675723472071783682177358395", "269123462518549626182616420424445080976", "10628864266787156032942855332068102196", "288353105007237176253432773326204834254", "179265687405319244813021154584500733258"], "threshold":0.9}, "id":"ASB-A-486385459-b4ef4ccb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/dbcba0975474be9589ee5ed4b809b5eb052e6468", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"284230453840811548508644633072343656261", "length":2312}, "id":"ASB-A-486385459-e9208a29", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/dbcba0975474be9589ee5ed4b809b5eb052e6468", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ec1b85f5159017b25a3c1353441f0dbae04623bc"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["228640235943044697760860749741364190128", "43953125796183454816142807662472777682", "58952132057675723472071783682177358395", "269123462518549626182616420424445080976", "10628864266787156032942855332068102196", "288353105007237176253432773326204834254", "179265687405319244813021154584500733258"], "threshold":0.9}, "id":"ASB-A-486385459-807e7f0a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ec1b85f5159017b25a3c1353441f0dbae04623bc", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"170752324650355765361253466071664364210", "length":2202}, "id":"ASB-A-486385459-ec2e3eb1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ec1b85f5159017b25a3c1353441f0dbae04623bc", "target":{"file":"packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java", "function":"onCreate"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}