{"id":"ASB-A-490605007", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28600", "A-490605007"], "details":"In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/c2f680bf6093ab63403d681d9d283e09797d6bfe"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["269643275258832763219810201022128309285", "143977629545445981829839722069500161958", "15434907803721309085010133421235260763", "26887444956522917119607886322404052261", "253128488464435898958424214939137236666", "266290051878553554220135927594165153896", "149356766050854835069309200948252449869", "223782692571102201550214551239572834815", "50136628364341449192579111435556949942", "244956004506230625950625067013422618896"], "threshold":0.9}, "id":"ASB-A-490605007-c3fa5f8a", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c2f680bf6093ab63403d681d9d283e09797d6bfe", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"}}, {"deprecated":false, "digest":{"function_hash":"14111201312336166118256428086376610140", "length":636}, "id":"ASB-A-490605007-f13d00c1", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c2f680bf6093ab63403d681d9d283e09797d6bfe", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/6d2904fff3751a7119c938084de6445cdf1b3281"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["269643275258832763219810201022128309285", "143977629545445981829839722069500161958", "15434907803721309085010133421235260763", "26887444956522917119607886322404052261", "253128488464435898958424214939137236666", "266290051878553554220135927594165153896", "149356766050854835069309200948252449869", "223782692571102201550214551239572834815", "50136628364341449192579111435556949942", "244956004506230625950625067013422618896"], "threshold":0.9}, "id":"ASB-A-490605007-05fafa33", "match_only_versions":["15"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6d2904fff3751a7119c938084de6445cdf1b3281", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"}}, {"deprecated":false, "digest":{"function_hash":"14111201312336166118256428086376610140", "length":636}, "id":"ASB-A-490605007-6581ba87", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/6d2904fff3751a7119c938084de6445cdf1b3281", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/26f09518a088de8bfe384d98900d5125ba76db9b"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"14111201312336166118256428086376610140", "length":636}, "id":"ASB-A-490605007-0754853b", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/26f09518a088de8bfe384d98900d5125ba76db9b", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["269643275258832763219810201022128309285", "143977629545445981829839722069500161958", "15434907803721309085010133421235260763", "26887444956522917119607886322404052261", "253128488464435898958424214939137236666", "266290051878553554220135927594165153896", "149356766050854835069309200948252449869", "223782692571102201550214551239572834815", "50136628364341449192579111435556949942", "244956004506230625950625067013422618896"], "threshold":0.9}, "id":"ASB-A-490605007-82c2a80d", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/26f09518a088de8bfe384d98900d5125ba76db9b", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/8a83e6bd2ca5dd61697861ad9359e657b0782560"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["269643275258832763219810201022128309285", "143977629545445981829839722069500161958", "15434907803721309085010133421235260763", "26887444956522917119607886322404052261", "253128488464435898958424214939137236666", "266290051878553554220135927594165153896", "149356766050854835069309200948252449869", "223782692571102201550214551239572834815", "50136628364341449192579111435556949942", "244956004506230625950625067013422618896"], "threshold":0.9}, "id":"ASB-A-490605007-4b59a4c7", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8a83e6bd2ca5dd61697861ad9359e657b0782560", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"}}, {"deprecated":false, "digest":{"function_hash":"14111201312336166118256428086376610140", "length":636}, "id":"ASB-A-490605007-4ea637e8", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8a83e6bd2ca5dd61697861ad9359e657b0782560", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/packages/apps/Settings", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/fc195079aa356a8455aac1aeea9d6d5597259be5"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"14111201312336166118256428086376610140", "length":636}, "id":"ASB-A-490605007-226847ac", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/fc195079aa356a8455aac1aeea9d6d5597259be5", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["269643275258832763219810201022128309285", "143977629545445981829839722069500161958", "15434907803721309085010133421235260763", "26887444956522917119607886322404052261", "253128488464435898958424214939137236666", "266290051878553554220135927594165153896", "149356766050854835069309200948252449869", "223782692571102201550214551239572834815", "50136628364341449192579111435556949942", "244956004506230625950625067013422618896"], "threshold":0.9}, "id":"ASB-A-490605007-3ad93c74", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Settings/+/fc195079aa356a8455aac1aeea9d6d5597259be5", "target":{"file":"src/com/android/settings/nfc/PaymentDefaultDialog.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}