{"id":"ASB-A-492683684", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28652", "A-492683684"], "details":"In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Uwb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-14c4d7e9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobClosed"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-19f8aa33", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobReconnected"}}, {"deprecated":false, "digest":{"line_hashes":["38025574417046419087244872309943817679", "219383566330742942559279915631243045000", "185135912870555563672284915387580312263", "173433282797485490505767597539997242327", "29139708090578226915345213323052656609", "288042904670986705202418402737485351350", "29061413810804428566142432396340218402", "97560675729739473506765559568672199436", "22464203180503072198750957484607585483", "258615435524748204944395670449476632235", "308547296153122471018986145785034232414", "317284501128887424070738296498326299284", "309368015486967817298265376259703181795", "281855938897929212484442110318842302836", "157710657525854923976036826425446734842", "194186333511653472015913527297243387010", "315802197048631648983702082296563952662", "225917967681048038367711200929891927587", "66508598726830257795702347688332316025", "20245729583690913768502141576095310351"], "threshold":0.9}, "id":"ASB-A-492683684-42d8b5d9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"91081891884775590369932405568289250434", "length":111}, "id":"ASB-A-492683684-a5b71b44", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"oobDataReceived"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-ae7f89a1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobDisconnected"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-c071e312", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1a1f98ef3e8ee5490e3c794aa9d21cddb87886ac", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"registerOobSendDataListener"}}]}}, {"package":{"name":"platform/packages/modules/Uwb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-05c86ffc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobDisconnected"}}, {"deprecated":false, "digest":{"line_hashes":["38025574417046419087244872309943817679", "219383566330742942559279915631243045000", "185135912870555563672284915387580312263", "173433282797485490505767597539997242327", "29139708090578226915345213323052656609", "288042904670986705202418402737485351350", "29061413810804428566142432396340218402", "97560675729739473506765559568672199436", "22464203180503072198750957484607585483", "258615435524748204944395670449476632235", "308547296153122471018986145785034232414", "317284501128887424070738296498326299284", "309368015486967817298265376259703181795", "281855938897929212484442110318842302836", "157710657525854923976036826425446734842", "194186333511653472015913527297243387010", "315802197048631648983702082296563952662", "225917967681048038367711200929891927587", "66508598726830257795702347688332316025", "20245729583690913768502141576095310351"], "threshold":0.9}, "id":"ASB-A-492683684-3a1febc1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-4778e163", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobReconnected"}}, {"deprecated":false, "digest":{"function_hash":"91081891884775590369932405568289250434", "length":111}, "id":"ASB-A-492683684-9fbdc654", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"oobDataReceived"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-af448cc1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobClosed"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-ee9824b9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d9680b2fa18cc80582c2dee005e772732a412068", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"registerOobSendDataListener"}}]}}, {"package":{"name":"platform/packages/modules/Uwb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-35a909fc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobDisconnected"}}, {"deprecated":false, "digest":{"line_hashes":["38025574417046419087244872309943817679", "219383566330742942559279915631243045000", "185135912870555563672284915387580312263", "173433282797485490505767597539997242327", "29139708090578226915345213323052656609", "288042904670986705202418402737485351350", "29061413810804428566142432396340218402", "97560675729739473506765559568672199436", "22464203180503072198750957484607585483", "258615435524748204944395670449476632235", "308547296153122471018986145785034232414", "317284501128887424070738296498326299284", "309368015486967817298265376259703181795", "281855938897929212484442110318842302836", "157710657525854923976036826425446734842", "194186333511653472015913527297243387010", "315802197048631648983702082296563952662", "225917967681048038367711200929891927587", "66508598726830257795702347688332316025", "20245729583690913768502141576095310351"], "threshold":0.9}, "id":"ASB-A-492683684-40de1af5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-5749fae8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobReconnected"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-68038073", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobClosed"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-6cab56e2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"registerOobSendDataListener"}}, {"deprecated":false, "digest":{"function_hash":"91081891884775590369932405568289250434", "length":111}, "id":"ASB-A-492683684-efc9fee3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d8bb74f96be6fbd0ee46fec8390076c53b510e9a", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"oobDataReceived"}}]}}, {"package":{"name":"platform/packages/modules/Uwb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"91081891884775590369932405568289250434", "length":111}, "id":"ASB-A-492683684-6a6c5c0d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"oobDataReceived"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-7f287d8b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobDisconnected"}}, {"deprecated":false, "digest":{"line_hashes":["38025574417046419087244872309943817679", "219383566330742942559279915631243045000", "185135912870555563672284915387580312263", "173433282797485490505767597539997242327", "29139708090578226915345213323052656609", "288042904670986705202418402737485351350", "29061413810804428566142432396340218402", "97560675729739473506765559568672199436", "22464203180503072198750957484607585483", "258615435524748204944395670449476632235", "308547296153122471018986145785034232414", "317284501128887424070738296498326299284", "309368015486967817298265376259703181795", "281855938897929212484442110318842302836", "157710657525854923976036826425446734842", "194186333511653472015913527297243387010", "315802197048631648983702082296563952662", "225917967681048038367711200929891927587", "66508598726830257795702347688332316025", "20245729583690913768502141576095310351"], "threshold":0.9}, "id":"ASB-A-492683684-9ab838be", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-a1097144", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobClosed"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-a4303a65", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"deviceOobReconnected"}}, {"deprecated":false, "digest":{"function_hash":"61649420881669196202136751094516715419", "length":89}, "id":"ASB-A-492683684-c7594db8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/d03cf8e3bb727c2a0b5d7c344f2bf01d033b3898", "target":{"file":"ranging/service/java/com/android/server/ranging/RangingServiceImpl.java", "function":"registerOobSendDataListener"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}