{"id":"ASB-A-490286986", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-45520", "A-490286986"], "details":"In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/6b7ef885f660aff17008c2877b19a2d3f2092242"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"67756539150316616114876162178971875030", "length":1074}, "id":"ASB-A-490286986-5f3d11b6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6b7ef885f660aff17008c2877b19a2d3f2092242", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"function_hash":"334536384417476101498381494442724719711", "length":169}, "id":"ASB-A-490286986-b516b5ce", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6b7ef885f660aff17008c2877b19a2d3f2092242", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onAttach"}}, {"deprecated":false, "digest":{"line_hashes":["266013248469367530516211167993356257144", "183018914160254208429551201570537819933", "255575075307225370172392080317523691185", "155608705476006980958368268239163745968", "44876849797973065076379241881343777461", "87971889901081849311959025249826382248", "175606439945410696549435957841352437534", "246916135784300232127517394721213787312", "124623234428632141775128737942774347228", "239321135813893053021249818361793315431", "55797953004768619557546723041091742054", "301874015409269983374382792769064287457", "276329781329376113384931982807441849137", "89931818239010217474870617722047295150", "286670727600748739089213927837058796953", "148872229339424841225469516903490069694", "178157735092430131084807462042600887483"], "threshold":0.9}, "id":"ASB-A-490286986-ecd1abd4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6b7ef885f660aff17008c2877b19a2d3f2092242", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/5594262d17d27bd2d2c72f257158476aa9fca184"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"334536384417476101498381494442724719711", "length":169}, "id":"ASB-A-490286986-0a1b71c6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5594262d17d27bd2d2c72f257158476aa9fca184", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onAttach"}}, {"deprecated":false, "digest":{"line_hashes":["266013248469367530516211167993356257144", "183018914160254208429551201570537819933", "255575075307225370172392080317523691185", "155608705476006980958368268239163745968", "275117753915911620844495392120985479590", "24093536037821666400717261829241534294", "185351861104084735789328578548980201206", "311986671698930286278043059445836939438", "124623234428632141775128737942774347228", "239321135813893053021249818361793315431", "55797953004768619557546723041091742054", "301874015409269983374382792769064287457", "276329781329376113384931982807441849137", "89931818239010217474870617722047295150", "286670727600748739089213927837058796953", "148872229339424841225469516903490069694", "178157735092430131084807462042600887483"], "threshold":0.9}, "id":"ASB-A-490286986-6695f5c9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5594262d17d27bd2d2c72f257158476aa9fca184", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java"}}, {"deprecated":false, "digest":{"function_hash":"336462243314677966746270009484678667211", "length":988}, "id":"ASB-A-490286986-a42d5134", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/5594262d17d27bd2d2c72f257158476aa9fca184", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/bcde52a6832b4ec0fcd8ef8c1b6b7cc40adb8f7b"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["266013248469367530516211167993356257144", "183018914160254208429551201570537819933", "255575075307225370172392080317523691185", "155608705476006980958368268239163745968", "44876849797973065076379241881343777461", "87971889901081849311959025249826382248", "175606439945410696549435957841352437534", "246916135784300232127517394721213787312", "124623234428632141775128737942774347228", "239321135813893053021249818361793315431", "55797953004768619557546723041091742054", "301874015409269983374382792769064287457", "276329781329376113384931982807441849137", "89931818239010217474870617722047295150", "286670727600748739089213927837058796953", "148872229339424841225469516903490069694", "178157735092430131084807462042600887483"], "threshold":0.9}, "id":"ASB-A-490286986-07d60be9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/bcde52a6832b4ec0fcd8ef8c1b6b7cc40adb8f7b", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java"}}, {"deprecated":false, "digest":{"function_hash":"334536384417476101498381494442724719711", "length":169}, "id":"ASB-A-490286986-37ff4a57", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/bcde52a6832b4ec0fcd8ef8c1b6b7cc40adb8f7b", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onAttach"}}, {"deprecated":false, "digest":{"function_hash":"67756539150316616114876162178971875030", "length":1074}, "id":"ASB-A-490286986-d626d2e6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/bcde52a6832b4ec0fcd8ef8c1b6b7cc40adb8f7b", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/a79e85eaffc817a2b0f3fa560f8befd99013b990"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"67756539150316616114876162178971875030", "length":1074}, "id":"ASB-A-490286986-5bb1aabe", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a79e85eaffc817a2b0f3fa560f8befd99013b990", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["266013248469367530516211167993356257144", "183018914160254208429551201570537819933", "255575075307225370172392080317523691185", "155608705476006980958368268239163745968", "44876849797973065076379241881343777461", "87971889901081849311959025249826382248", "175606439945410696549435957841352437534", "246916135784300232127517394721213787312", "124623234428632141775128737942774347228", "239321135813893053021249818361793315431", "55797953004768619557546723041091742054", "301874015409269983374382792769064287457", "276329781329376113384931982807441849137", "89931818239010217474870617722047295150", "286670727600748739089213927837058796953", "148872229339424841225469516903490069694", "178157735092430131084807462042600887483"], "threshold":0.9}, "id":"ASB-A-490286986-8da2f768", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a79e85eaffc817a2b0f3fa560f8befd99013b990", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java"}}, {"deprecated":false, "digest":{"function_hash":"334536384417476101498381494442724719711", "length":169}, "id":"ASB-A-490286986-a167822b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/a79e85eaffc817a2b0f3fa560f8befd99013b990", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onAttach"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/c50b2a121cf3b1def5d63d041823f3fe7a9eb8d5"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["266013248469367530516211167993356257144", "183018914160254208429551201570537819933", "255575075307225370172392080317523691185", "155608705476006980958368268239163745968", "44876849797973065076379241881343777461", "87971889901081849311959025249826382248", "175606439945410696549435957841352437534", "246916135784300232127517394721213787312", "124623234428632141775128737942774347228", "239321135813893053021249818361793315431", "55797953004768619557546723041091742054", "301874015409269983374382792769064287457", "276329781329376113384931982807441849137", "89931818239010217474870617722047295150", "286670727600748739089213927837058796953", "148872229339424841225469516903490069694", "178157735092430131084807462042600887483"], "threshold":0.9}, "id":"ASB-A-490286986-42cbfffc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c50b2a121cf3b1def5d63d041823f3fe7a9eb8d5", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java"}}, {"deprecated":false, "digest":{"function_hash":"67756539150316616114876162178971875030", "length":1074}, "id":"ASB-A-490286986-b2bec1b1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c50b2a121cf3b1def5d63d041823f3fe7a9eb8d5", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"function_hash":"334536384417476101498381494442724719711", "length":169}, "id":"ASB-A-490286986-b50a7ccf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c50b2a121cf3b1def5d63d041823f3fe7a9eb8d5", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onAttach"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/b41124d37d5091f4c2e92206ca5593464029fa4c"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["31184373393030127358797901577249342438", "83730654694629818981755853490330110559", "193800330630864233408617458196442208655", "266013248469367530516211167993356257144", "183018914160254208429551201570537819933", "255575075307225370172392080317523691185", "155608705476006980958368268239163745968", "275117753915911620844495392120985479590", "24093536037821666400717261829241534294", "185351861104084735789328578548980201206", "311986671698930286278043059445836939438", "124623234428632141775128737942774347228", "239321135813893053021249818361793315431", "55797953004768619557546723041091742054", "301874015409269983374382792769064287457", "276329781329376113384931982807441849137", "89931818239010217474870617722047295150", "286670727600748739089213927837058796953", "148872229339424841225469516903490069694", "178157735092430131084807462042600887483"], "threshold":0.9}, "id":"ASB-A-490286986-430d95fe", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/b41124d37d5091f4c2e92206ca5593464029fa4c", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java"}}, {"deprecated":false, "digest":{"function_hash":"336462243314677966746270009484678667211", "length":988}, "id":"ASB-A-490286986-5a2121ea", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/b41124d37d5091f4c2e92206ca5593464029fa4c", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"function_hash":"334536384417476101498381494442724719711", "length":169}, "id":"ASB-A-490286986-b2deda8a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/b41124d37d5091f4c2e92206ca5593464029fa4c", "target":{"file":"src/com/android/settings/biometrics/combination/BiometricsSettingsBase.java", "function":"onAttach"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}