{"id":"ASB-A-498916138", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28657", "A-498916138"], "details":"In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e2c75d70260ad97f24feef6b8ec1a0ebfe364347"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"311704568954905544218201527300819541202", "length":286}, "id":"ASB-A-498916138-6cd6a46e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e2c75d70260ad97f24feef6b8ec1a0ebfe364347", "target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java", "function":"onActivityResult"}}, {"deprecated":false, "digest":{"line_hashes":["237016630149306421452840928473007703053", "50143385128495565907010397505966602007", "88100196006281129937411128248127776562", "140559082213086012803180817233321705467", "228608869399389294870407046796633210727", "74252292172099829220238198815578687459", "224263778142613551284112330002219923970", "175302810258537392142677048446428414616", "84568215179344273222986484452005504446", "282088641526453108010441287455962860942", "4852878632377954103182448372210044214"], "threshold":0.9}, "id":"ASB-A-498916138-c290cb35", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e2c75d70260ad97f24feef6b8ec1a0ebfe364347", "target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7c0b971945321ee139c71abb27c77732737c5b0f"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["175302810258537392142677048446428414616", "84568215179344273222986484452005504446", "282088641526453108010441287455962860942", "4852878632377954103182448372210044214"], "threshold":0.9}, "id":"ASB-A-498916138-0802f198", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7c0b971945321ee139c71abb27c77732737c5b0f", "target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java"}}, {"deprecated":false, "digest":{"function_hash":"311704568954905544218201527300819541202", "length":286}, "id":"ASB-A-498916138-e37995a4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7c0b971945321ee139c71abb27c77732737c5b0f", "target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java", "function":"onActivityResult"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/80e84dab91f60a4c7175759802b30d4ad3241c39"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["237016630149306421452840928473007703053", "50143385128495565907010397505966602007", "88100196006281129937411128248127776562", "140559082213086012803180817233321705467", "228608869399389294870407046796633210727", "74252292172099829220238198815578687459", "224263778142613551284112330002219923970", "175302810258537392142677048446428414616", "84568215179344273222986484452005504446", "282088641526453108010441287455962860942", "4852878632377954103182448372210044214"], "threshold":0.9}, "id":"ASB-A-498916138-31760a5b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/80e84dab91f60a4c7175759802b30d4ad3241c39", "target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java"}}, {"deprecated":false, "digest":{"function_hash":"311704568954905544218201527300819541202", "length":286}, "id":"ASB-A-498916138-a71eb1a6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/80e84dab91f60a4c7175759802b30d4ad3241c39", "target":{"file":"core/java/android/appwidget/AppWidgetConfigActivityProxy.java", "function":"onActivityResult"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}