{"id":"ASB-A-487522353", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-09T15:15:54.249544283Z", "aliases":["CVE-2026-28582", "A-487522353"], "details":"In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"225355106264462343682862456478620329099", "length":5863}, "id":"ASB-A-487522353-0c9800eb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["9652668052313215211809457435577099329", "42302541755554764317914228322417196827", "182510943443562764666308444493969446172", "268510628125414722993030442318504867595", "102830875642936636489652925739976357282", "122815770119339302529597811558588685136", "231546043599135225282422895037581395220"], "threshold":0.9}, "id":"ASB-A-487522353-6d97024b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"}}, {"deprecated":false, "digest":{"line_hashes":["50448111178302970871280963852843707910", "73631506534017129656694136800952130062", "272470036045758090437155815418827724949", "159824744492675985466948094975854045731"], "threshold":0.9}, "id":"ASB-A-487522353-b1b85ee4", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4e2cf5e22953a3d3c9957d448cf69fd8d6ecaead", "target":{"file":"tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["50448111178302970871280963852843707910", "73631506534017129656694136800952130062", "272470036045758090437155815418827724949", "159824744492675985466948094975854045731"], "threshold":0.9}, "id":"ASB-A-487522353-8bd60f9d", "match_only_versions":["15"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3", "target":{"file":"tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"}}, {"deprecated":false, "digest":{"line_hashes":["9652668052313215211809457435577099329", "42302541755554764317914228322417196827", "182510943443562764666308444493969446172", "268510628125414722993030442318504867595", "102830875642936636489652925739976357282", "122815770119339302529597811558588685136", "231546043599135225282422895037581395220"], "threshold":0.9}, "id":"ASB-A-487522353-de1e6631", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"320482628526730975322324512763471195204", "length":5039}, "id":"ASB-A-487522353-eb31bad5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/556ba308ff57c4f5d17eb36371dc4905cc3bcaa3", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["50448111178302970871280963852843707910", "73631506534017129656694136800952130062", "272470036045758090437155815418827724949", "159824744492675985466948094975854045731"], "threshold":0.9}, "id":"ASB-A-487522353-218e8dc4", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737", "target":{"file":"tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"}}, {"deprecated":false, "digest":{"function_hash":"257570518455334185191298288611603367511", "length":6086}, "id":"ASB-A-487522353-e39e82fa", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["9652668052313215211809457435577099329", "42302541755554764317914228322417196827", "182510943443562764666308444493969446172", "268510628125414722993030442318504867595", "102830875642936636489652925739976357282", "122815770119339302529597811558588685136", "231546043599135225282422895037581395220"], "threshold":0.9}, "id":"ASB-A-487522353-e61efb9b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/1007fdf8c8dee7ab60ad005d4a3316277d1ea737", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/83dbc69ae56bdd5dfdb562f44a86f488378e40fe"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["9652668052313215211809457435577099329", "42302541755554764317914228322417196827", "182510943443562764666308444493969446172", "268510628125414722993030442318504867595", "102830875642936636489652925739976357282", "122815770119339302529597811558588685136", "231546043599135225282422895037581395220"], "threshold":0.9}, "id":"ASB-A-487522353-480c53cf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/83dbc69ae56bdd5dfdb562f44a86f488378e40fe", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"270794111176202381152047372900889284977", "length":5955}, "id":"ASB-A-487522353-c8c65ff9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/83dbc69ae56bdd5dfdb562f44a86f488378e40fe", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["9652668052313215211809457435577099329", "42302541755554764317914228322417196827", "182510943443562764666308444493969446172", "268510628125414722993030442318504867595", "102830875642936636489652925739976357282", "122815770119339302529597811558588685136", "231546043599135225282422895037581395220"], "threshold":0.9}, "id":"ASB-A-487522353-c48c9431", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"225355106264462343682862456478620329099", "length":5863}, "id":"ASB-A-487522353-d429800a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["50448111178302970871280963852843707910", "73631506534017129656694136800952130062", "272470036045758090437155815418827724949", "159824744492675985466948094975854045731"], "threshold":0.9}, "id":"ASB-A-487522353-f97d7f66", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a7189922c9461e0fb802b590dc8225611e7ea205", "target":{"file":"tests/robotests/testutils/com/android/settings/testutils/shadow/ShadowLockPatternUtils.java"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/319bd99e56dbc79207713063fe8a19bbe9f71f72"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"36075075032965457562063846557597081223", "length":3198}, "id":"ASB-A-487522353-23b50908", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/319bd99e56dbc79207713063fe8a19bbe9f71f72", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["287616441439893114008460994366789998014", "294793562361303601986062338465746709359", "147597210763174070709041303428320196360", "130210970787776341656751929764056254081", "79856535076905567870523655038863588052", "334101330933833103231535792610573397536", "263087673580089959162153258465159764742"], "threshold":0.9}, "id":"ASB-A-487522353-67892b56", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/319bd99e56dbc79207713063fe8a19bbe9f71f72", "target":{"file":"src/com/android/settings/password/ConfirmDeviceCredentialActivity.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}