{"id":"ASB-A-500368515", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58957", "A-500368515"], "details":"In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/038570272e1bffb436ba462a17019ee1591e6ea2"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"208541534460384948833338299093157541976", "length":2513}, "id":"ASB-A-500368515-2e881220", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/038570272e1bffb436ba462a17019ee1591e6ea2", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveToHeavyWeightSwitcherIfNeeded"}}, {"deprecated":false, "digest":{"line_hashes":["262393294667374548033073179435608603727", "185767816261428529599732507358338687409", "2794047396836808824727809203415499785", "328319832459946279802342749576007426665", "76711921162984927464940564694963012342", "114453219737195865279216126144651768457", "127969907326923251870947243259122396355", "177747119237921070628884928215625249740", "251165073482809034947053272683998112528", "335217149137500581974031050117146731004", "188787713035632447775610434457095139296", "284865945246284946780412976973192343533", "147702096036081541563886442426695764811", "95324265733025569373517630511986400327", "264129475696548534827926576125744390365", "246966273701212530409304353138918305123", "113757763372197570081243132480577431092"], "threshold":0.9}, "id":"ASB-A-500368515-348ada24", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/038570272e1bffb436ba462a17019ee1591e6ea2", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fd53cee662011b8c941ed128c46da310c01d5625"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["121627612520486245863375107390968337961", "293768016984612675264427475236103031404", "2794047396836808824727809203415499785", "328319832459946279802342749576007426665", "76711921162984927464940564694963012342", "114453219737195865279216126144651768457", "127969907326923251870947243259122396355", "177747119237921070628884928215625249740", "338460634918020054896853830242271131569", "31954128021861864275942091384272148764", "290241155291904266061664649701699576592", "206134399752924949617700129147085569876", "147702096036081541563886442426695764811", "95324265733025569373517630511986400327", "264129475696548534827926576125744390365", "246966273701212530409304353138918305123", "113757763372197570081243132480577431092"], "threshold":0.9}, "id":"ASB-A-500368515-4273cc51", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fd53cee662011b8c941ed128c46da310c01d5625", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"168741367883641637588844732969743879242", "length":2536}, "id":"ASB-A-500368515-61f07508", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fd53cee662011b8c941ed128c46da310c01d5625", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveToHeavyWeightSwitcherIfNeeded"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/842a7d49c6355280a3e60ff55bd3798a4ba6ba0f"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["262393294667374548033073179435608603727", "185767816261428529599732507358338687409", "2794047396836808824727809203415499785", "328319832459946279802342749576007426665", "76711921162984927464940564694963012342", "114453219737195865279216126144651768457", "127969907326923251870947243259122396355", "177747119237921070628884928215625249740", "338460634918020054896853830242271131569", "31954128021861864275942091384272148764", "290241155291904266061664649701699576592", "206134399752924949617700129147085569876", "147702096036081541563886442426695764811", "95324265733025569373517630511986400327", "264129475696548534827926576125744390365", "246966273701212530409304353138918305123", "113757763372197570081243132480577431092"], "threshold":0.9}, "id":"ASB-A-500368515-91401fe5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/842a7d49c6355280a3e60ff55bd3798a4ba6ba0f", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"168741367883641637588844732969743879242", "length":2536}, "id":"ASB-A-500368515-dd607f97", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/842a7d49c6355280a3e60ff55bd3798a4ba6ba0f", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveToHeavyWeightSwitcherIfNeeded"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7dfe78705e17c1fcc80bba541910516369d7579e"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"168741367883641637588844732969743879242", "length":2536}, "id":"ASB-A-500368515-5189ea5e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7dfe78705e17c1fcc80bba541910516369d7579e", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveToHeavyWeightSwitcherIfNeeded"}}, {"deprecated":false, "digest":{"line_hashes":["262393294667374548033073179435608603727", "185767816261428529599732507358338687409", "2794047396836808824727809203415499785", "328319832459946279802342749576007426665", "76711921162984927464940564694963012342", "114453219737195865279216126144651768457", "127969907326923251870947243259122396355", "177747119237921070628884928215625249740", "338460634918020054896853830242271131569", "31954128021861864275942091384272148764", "290241155291904266061664649701699576592", "206134399752924949617700129147085569876", "147702096036081541563886442426695764811", "95324265733025569373517630511986400327", "264129475696548534827926576125744390365", "246966273701212530409304353138918305123", "113757763372197570081243132480577431092"], "threshold":0.9}, "id":"ASB-A-500368515-72e36dc5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7dfe78705e17c1fcc80bba541910516369d7579e", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f9391d85900cc3200fa14f6bc1ca52932454c0ab"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"208541534460384948833338299093157541976", "length":2513}, "id":"ASB-A-500368515-50c14f21", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9391d85900cc3200fa14f6bc1ca52932454c0ab", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveToHeavyWeightSwitcherIfNeeded"}}, {"deprecated":false, "digest":{"line_hashes":["262393294667374548033073179435608603727", "185767816261428529599732507358338687409", "2794047396836808824727809203415499785", "328319832459946279802342749576007426665", "76711921162984927464940564694963012342", "114453219737195865279216126144651768457", "127969907326923251870947243259122396355", "177747119237921070628884928215625249740", "251165073482809034947053272683998112528", "335217149137500581974031050117146731004", "188787713035632447775610434457095139296", "284865945246284946780412976973192343533", "147702096036081541563886442426695764811", "95324265733025569373517630511986400327", "264129475696548534827926576125744390365", "246966273701212530409304353138918305123", "113757763372197570081243132480577431092"], "threshold":0.9}, "id":"ASB-A-500368515-c5d34457", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f9391d85900cc3200fa14f6bc1ca52932454c0ab", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/53f78b87480a894abb2806a2b101a91fced08d33"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["121627612520486245863375107390968337961", "293768016984612675264427475236103031404", "2794047396836808824727809203415499785", "328319832459946279802342749576007426665", "76711921162984927464940564694963012342", "114453219737195865279216126144651768457", "127969907326923251870947243259122396355", "177747119237921070628884928215625249740", "338460634918020054896853830242271131569", "31954128021861864275942091384272148764", "290241155291904266061664649701699576592", "206134399752924949617700129147085569876", "147702096036081541563886442426695764811", "95324265733025569373517630511986400327", "264129475696548534827926576125744390365", "246966273701212530409304353138918305123", "113757763372197570081243132480577431092"], "threshold":0.9}, "id":"ASB-A-500368515-7464727b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/53f78b87480a894abb2806a2b101a91fced08d33", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java"}}, {"deprecated":false, "digest":{"function_hash":"168741367883641637588844732969743879242", "length":2536}, "id":"ASB-A-500368515-c4667edd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/53f78b87480a894abb2806a2b101a91fced08d33", "target":{"file":"services/core/java/com/android/server/wm/ActivityStarter.java", "function":"resolveToHeavyWeightSwitcherIfNeeded"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}