{"id":"ASB-A-491748298", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-45521", "A-491748298"], "details":"In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["68045358585044474446901610051439424734", "250326445565784778221853878595895170606", "178991010253533399621632707677886416764", "277651685365647603381083296012695307991", "33910646580015812090253805627061887362", "189441484385343235705717260470742951750", "118487118811602319524549213924714398637", "113403240795576765742663726004218098615"], "threshold":0.9}, "id":"ASB-A-491748298-1d26dc8f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"14896423120790572720039217425494905313", "length":504}, "id":"ASB-A-491748298-2027f7b1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java", "function":"openFile"}}, {"deprecated":false, "digest":{"function_hash":"298992070416577973243581378451983588942", "length":523}, "id":"ASB-A-491748298-32356aa8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"openProxyFileDescriptor"}}, {"deprecated":false, "digest":{"line_hashes":["141719123259839516007060757372302818956", "73261760971868016508560516057191027614", "168944687444037655817931836439574434632", "241740515989576591599297069621103948289", "76268198549368217911361443251866758233", "236396324232536418671494321407880789372", "238567063692417096492463078415612943735", "13447263821089926019812060962662837557", "82213311895402701621995098103434020533"], "threshold":0.9}, "id":"ASB-A-491748298-8065b718", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7231c8493ec30c2fab8d9e6de0fd842ffb5a37c8", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["141719123259839516007060757372302818956", "73261760971868016508560516057191027614", "168944687444037655817931836439574434632", "241740515989576591599297069621103948289", "76268198549368217911361443251866758233", "236396324232536418671494321407880789372", "238567063692417096492463078415612943735", "13447263821089926019812060962662837557", "82213311895402701621995098103434020533"], "threshold":0.9}, "id":"ASB-A-491748298-7bde1ab3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"}}, {"deprecated":false, "digest":{"function_hash":"298992070416577973243581378451983588942", "length":523}, "id":"ASB-A-491748298-8a4c9fa1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"openProxyFileDescriptor"}}, {"deprecated":false, "digest":{"line_hashes":["68045358585044474446901610051439424734", "250326445565784778221853878595895170606", "178991010253533399621632707677886416764", "277651685365647603381083296012695307991", "33910646580015812090253805627061887362", "189441484385343235705717260470742951750", "118487118811602319524549213924714398637", "113403240795576765742663726004218098615"], "threshold":0.9}, "id":"ASB-A-491748298-e541d4fc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"14896423120790572720039217425494905313", "length":504}, "id":"ASB-A-491748298-edeac4ed", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6f99a1866c92b532bf7ddb3b2970f4ce88b40964", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java", "function":"openFile"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["68045358585044474446901610051439424734", "250326445565784778221853878595895170606", "178991010253533399621632707677886416764", "277651685365647603381083296012695307991", "33910646580015812090253805627061887362", "189441484385343235705717260470742951750", "118487118811602319524549213924714398637", "113403240795576765742663726004218098615"], "threshold":0.9}, "id":"ASB-A-491748298-68d6b782", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}, {"deprecated":false, "digest":{"line_hashes":["141719123259839516007060757372302818956", "73261760971868016508560516057191027614", "168944687444037655817931836439574434632", "241740515989576591599297069621103948289", "76268198549368217911361443251866758233", "236396324232536418671494321407880789372", "238567063692417096492463078415612943735", "13447263821089926019812060962662837557", "82213311895402701621995098103434020533"], "threshold":0.9}, "id":"ASB-A-491748298-913eda85", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"}}, {"deprecated":false, "digest":{"function_hash":"298992070416577973243581378451983588942", "length":523}, "id":"ASB-A-491748298-d9d60c06", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"openProxyFileDescriptor"}}, {"deprecated":false, "digest":{"function_hash":"14896423120790572720039217425494905313", "length":504}, "id":"ASB-A-491748298-f9b9caca", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/50e00c7f6f6fc5979f6cd3f7eae73b14415d8cb9", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java", "function":"openFile"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["141719123259839516007060757372302818956", "73261760971868016508560516057191027614", "168944687444037655817931836439574434632", "241740515989576591599297069621103948289", "76268198549368217911361443251866758233", "236396324232536418671494321407880789372", "238567063692417096492463078415612943735", "13447263821089926019812060962662837557", "82213311895402701621995098103434020533"], "threshold":0.9}, "id":"ASB-A-491748298-60caabba", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"}}, {"deprecated":false, "digest":{"function_hash":"298992070416577973243581378451983588942", "length":523}, "id":"ASB-A-491748298-808ee7c7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"openProxyFileDescriptor"}}, {"deprecated":false, "digest":{"line_hashes":["68045358585044474446901610051439424734", "250326445565784778221853878595895170606", "178991010253533399621632707677886416764", "277651685365647603381083296012695307991", "33910646580015812090253805627061887362", "189441484385343235705717260470742951750", "118487118811602319524549213924714398637", "113403240795576765742663726004218098615"], "threshold":0.9}, "id":"ASB-A-491748298-b203450c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"14896423120790572720039217425494905313", "length":504}, "id":"ASB-A-491748298-bff8d0cf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7ae0151eec00186f5faa14b4504f30db3f644bbb", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java", "function":"openFile"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["68045358585044474446901610051439424734", "250326445565784778221853878595895170606", "178991010253533399621632707677886416764", "277651685365647603381083296012695307991", "33910646580015812090253805627061887362", "189441484385343235705717260470742951750", "118487118811602319524549213924714398637", "113403240795576765742663726004218098615"], "threshold":0.9}, "id":"ASB-A-491748298-9537655b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"298992070416577973243581378451983588942", "length":523}, "id":"ASB-A-491748298-bffb24ca", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"openProxyFileDescriptor"}}, {"deprecated":false, "digest":{"function_hash":"14896423120790572720039217425494905313", "length":504}, "id":"ASB-A-491748298-c5ff2b40", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java", "function":"openFile"}}, {"deprecated":false, "digest":{"line_hashes":["141719123259839516007060757372302818956", "73261760971868016508560516057191027614", "168944687444037655817931836439574434632", "241740515989576591599297069621103948289", "76268198549368217911361443251866758233", "236396324232536418671494321407880789372", "238567063692417096492463078415612943735", "13447263821089926019812060962662837557", "82213311895402701621995098103434020533"], "threshold":0.9}, "id":"ASB-A-491748298-ce11a253", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/949dd5dad507def8bfe26b50bdba8eddfc487501", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["68045358585044474446901610051439424734", "250326445565784778221853878595895170606", "178991010253533399621632707677886416764", "277651685365647603381083296012695307991", "33910646580015812090253805627061887362", "189441484385343235705717260470742951750", "118487118811602319524549213924714398637", "113403240795576765742663726004218098615"], "threshold":0.9}, "id":"ASB-A-491748298-1a750c28", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}, {"deprecated":false, "digest":{"line_hashes":["141719123259839516007060757372302818956", "73261760971868016508560516057191027614", "168944687444037655817931836439574434632", "241740515989576591599297069621103948289", "76268198549368217911361443251866758233", "236396324232536418671494321407880789372", "238567063692417096492463078415612943735", "13447263821089926019812060962662837557", "82213311895402701621995098103434020533"], "threshold":0.9}, "id":"ASB-A-491748298-4cb5360f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java"}}, {"deprecated":false, "digest":{"function_hash":"14896423120790572720039217425494905313", "length":504}, "id":"ASB-A-491748298-621423d1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15", "target":{"file":"services/core/java/com/android/server/storage/AppFuseBridge.java", "function":"openFile"}}, {"deprecated":false, "digest":{"function_hash":"298992070416577973243581378451983588942", "length":523}, "id":"ASB-A-491748298-d90d7d0e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/739ad9ff79d67e26f06bad974c4df68668cf5f15", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"openProxyFileDescriptor"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}