{"id":"ASB-A-497544808", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28611", "A-497544808"], "details":"In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"145683630974362096072968605857705983066", "length":3151}, "id":"ASB-A-497544808-591cb063", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"setReaderMode"}}, {"deprecated":false, "digest":{"function_hash":"237234351477676370667634539421276327217", "length":2101}, "id":"ASB-A-497544808-5c78cc4c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"setObserveMode"}}, {"deprecated":false, "digest":{"function_hash":"265777529305273559796576123193308485775", "length":1240}, "id":"ASB-A-497544808-a783f63a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"disable"}}, {"deprecated":false, "digest":{"function_hash":"239122068815507389811696308729534070105", "length":1666}, "id":"ASB-A-497544808-afc424bc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"enable"}}, {"deprecated":false, "digest":{"function_hash":"261696602871462327323971925813227222894", "length":4208}, "id":"ASB-A-497544808-c2bf5fd9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"updateDiscoveryTechnology"}}, {"deprecated":false, "digest":{"function_hash":"92368584954975034970821966423706717393", "length":616}, "id":"ASB-A-497544808-c5bf3078", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"indicateDataMigration"}}, {"deprecated":false, "digest":{"line_hashes":["69205547113887266068518823224605502267", "223840672871161281574186763545393098309", "252403233024895884755194562494749533092", "5944225885217768981174676348504078912", "86023815439605145093715809987945259005", "82975587123365214081206607249417658", "325758782967844088286221920727569750221", "26061156286725583050350185489114847447", "189036049833329939188541568722233512569", "5944225885217768981174676348504078912", "86023815439605145093715809987945259005", "82975587123365214081206607249417658", "191303302751989509012046826745326591411", "71206970072727764472179681134870851206", "278995233214764222220983802419778036455", "322260598877903237889138085121648349823", "63347763038648270700707724389435817852", "241439289263365029563955214458572132899", "146138177818502707739664887339077044230", "49492440979189719781086095979495023592", "81858657170600474943572318080930234062", "60448725326329302658509307918809406709", "294872942792411638511868819279631651856", "211535723430463090126709567016729928356", "118426360523720135475786508033925427186", "257676172060963152924892957730751204968", "81858657170600474943572318080930234062", "150312388581316878391767366313334151868", "226886623327191727632172985324627866722", "10088064794857335950242766556883115608", "251396540005101835005974386287738425816", "197364854751080878007150759032904307380", "236698731208856873077628429925431946120", "5331249002279309185002535410000684742", "79974554043902973053202358796376875474", "18108656312709554699160905968840516889"], "threshold":0.9}, "id":"ASB-A-497544808-f1c16025", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/7b40ea922150f05b3ea067005a53400f2a313040", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java"}}]}}, {"package":{"name":"platform/packages/apps/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"128026890074346895050553221364004724732", "length":1971}, "id":"ASB-A-497544808-1f9678c6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9", "target":{"file":"src/com/android/nfc/NfcService.java", "function":"setObserveMode"}}, {"deprecated":false, "digest":{"function_hash":"128268047118787842790280521556671856318", "length":47}, "id":"ASB-A-497544808-2b6105e4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9", "target":{"file":"src/com/android/nfc/NfcPermissions.java", "function":"NfcPermissions"}}, {"deprecated":false, "digest":{"line_hashes":["45216410068772303476179510506710438591", "42225182403007286670159495166329417411", "285947112621472329395811251621730932101", "198668885382374481451112312706876850291", "294218935381908821537056423525558823820", "272655404112960425583652546923187180015", "3740093818984911944090468567441465362", "28048474000066755449228687525090511900", "103662245915556943784179512227706888254", "116488047471259479470762969900484057071", "238885325020635941023712010175219965721", "135991937613766438531817900831988694922"], "threshold":0.9}, "id":"ASB-A-497544808-48c2bf06", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9", "target":{"file":"src/com/android/nfc/NfcService.java"}}, {"deprecated":false, "digest":{"function_hash":"324323340451671305577626903777163313287", "length":892}, "id":"ASB-A-497544808-4adf2bfa", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9", "target":{"file":"src/com/android/nfc/NfcService.java", "function":"disable"}}, {"deprecated":false, "digest":{"function_hash":"126493090679821232874191917315963087065", "length":1195}, "id":"ASB-A-497544808-b3abbd6b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9", "target":{"file":"src/com/android/nfc/NfcService.java", "function":"enable"}}, {"deprecated":false, "digest":{"line_hashes":["7532320810051387249591001405386457390", "75340458277115490981875896555826603649", "6811014069132401629002944300020367163", "329050400345450364928837027295116904414", "184728700489855773840354683261854473198", "157313238185269734371328083852511581439", "97926044348150109862872479918366346863", "264261439526995264911649148160513103392", "183294740712613140801359953412122588019", "202256548282891204996427824974724142654", "246239478320250421325549291732446786869", "91110940583516536628521317555625609168"], "threshold":0.9}, "id":"ASB-A-497544808-e4ae95c8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/apps/Nfc/+/b187a74b6abd05d8607cfa9c373bfcd5d0612cc9", "target":{"file":"src/com/android/nfc/NfcPermissions.java"}}]}}, {"package":{"name":"platform/packages/modules/Nfc", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"237234351477676370667634539421276327217", "length":2101}, "id":"ASB-A-497544808-16e47bcf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"setObserveMode"}}, {"deprecated":false, "digest":{"function_hash":"92368584954975034970821966423706717393", "length":616}, "id":"ASB-A-497544808-2a893363", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"indicateDataMigration"}}, {"deprecated":false, "digest":{"function_hash":"282740423134334196702566285651825695021", "length":4236}, "id":"ASB-A-497544808-4ac80df0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"updateDiscoveryTechnology"}}, {"deprecated":false, "digest":{"line_hashes":["69205547113887266068518823224605502267", "223840672871161281574186763545393098309", "252403233024895884755194562494749533092", "5944225885217768981174676348504078912", "86023815439605145093715809987945259005", "82975587123365214081206607249417658", "325758782967844088286221920727569750221", "26061156286725583050350185489114847447", "189036049833329939188541568722233512569", "5944225885217768981174676348504078912", "86023815439605145093715809987945259005", "82975587123365214081206607249417658", "191303302751989509012046826745326591411", "71206970072727764472179681134870851206", "278995233214764222220983802419778036455", "322260598877903237889138085121648349823", "63347763038648270700707724389435817852", "241439289263365029563955214458572132899", "146138177818502707739664887339077044230", "49492440979189719781086095979495023592", "81858657170600474943572318080930234062", "60448725326329302658509307918809406709", "294872942792411638511868819279631651856", "211535723430463090126709567016729928356", "118426360523720135475786508033925427186", "257676172060963152924892957730751204968", "81858657170600474943572318080930234062", "150312388581316878391767366313334151868", "226886623327191727632172985324627866722", "10088064794857335950242766556883115608", "251396540005101835005974386287738425816", "197364854751080878007150759032904307380", "236698731208856873077628429925431946120", "5331249002279309185002535410000684742", "79974554043902973053202358796376875474", "18108656312709554699160905968840516889"], "threshold":0.9}, "id":"ASB-A-497544808-99d7b66d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java"}}, {"deprecated":false, "digest":{"function_hash":"313129892655125198357375658641930504441", "length":1680}, "id":"ASB-A-497544808-bd9486fb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"enable"}}, {"deprecated":false, "digest":{"function_hash":"73479498194997688904024993702543971352", "length":3017}, "id":"ASB-A-497544808-bdc7688c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"setReaderMode"}}, {"deprecated":false, "digest":{"function_hash":"249839188500909481740527359787784670808", "length":1254}, "id":"ASB-A-497544808-d98b3bc0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Nfc/+/c2982b70ee1c81ab5bb5a7a653a4196fe1a4be89", "target":{"file":"NfcNci/src/com/android/nfc/NfcService.java", "function":"disable"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}