{"id":"ASB-A-496735702", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-09T15:27:06.151355248Z", "aliases":["CVE-2026-28574", "A-496735702"], "details":"In onServiceConnected of HostEmulationManager.java, there is a possible way to perform BAL due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["86688120992371390739020006842299055484", "215223423322781899579547143707049384550", "275464154574438694425345713387515178782", "326020092990932437683134700065233243053"], "threshold":0.9}, "id":"ASB-A-496735702-24692715", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"}}, {"deprecated":false, "digest":{"function_hash":"141656006104620151990289342286865021790", "length":1988}, "id":"ASB-A-496735702-b9aef8bb", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/6564c573280aad995b6e71536a1b8c190c63afea", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"onServiceConnected"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["33761003995606516348867317978512480547", "264491105238813284431707904219229667689", "231588233561071738439720740133199140598", "303451526792491032741878816960172378737"], "threshold":0.9}, "id":"ASB-A-496735702-b801f6c5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"}}, {"deprecated":false, "digest":{"function_hash":"154034435489838502234758318852156583301", "length":1774}, "id":"ASB-A-496735702-d5f65333", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/8559b91e8d43dad73f579666b6688922c947ca9e", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"onServiceConnected"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["86688120992371390739020006842299055484", "215223423322781899579547143707049384550", "275464154574438694425345713387515178782", "326020092990932437683134700065233243053"], "threshold":0.9}, "id":"ASB-A-496735702-734cadce", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java"}}, {"deprecated":false, "digest":{"function_hash":"247534031965832360392989219577962126912", "length":1789}, "id":"ASB-A-496735702-f40910d8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c5c23ea09d082c9c63e83928c3c28bb48fd1625e", "target":{"file":"NfcNci/src/com/android/nfc/cardemulation/HostEmulationManager.java", "function":"onServiceConnected"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/packages/modules/Nfc/+/477d0eb9f0f6ff7c0d40b7c19ce71aa4a294dc13"}]}