{"id":"ASB-A-504573577", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-11T15:42:03.104094163Z", "aliases":["CVE-2026-45528", "A-504573577"], "details":"In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/47b53f56d755c6dad4485f47ac1991617bbe13c0"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"205252167446257727346328416984313230428", "length":1537}, "id":"ASB-A-504573577-1bbf0545", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/47b53f56d755c6dad4485f47ac1991617bbe13c0", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"getManageSpaceActivityIntent"}}, {"deprecated":false, "digest":{"line_hashes":["117736704502356082521070447074097171566", "125490234255071380010985167478587616428", "32294471679903276015822303206198258448", "260195633351507410969188211581959614743", "110840983427967077748798182639788265417", "41023389055900421361787190169380042586", "117240276386761738484583127818131850446", "14411765041829276630199275769454745808", "336025351691242334738892371564604563998", "194341022521932644254444767754294751258", "219036716359787749560571810779249817910", "175234704493882289032039541917827817873", "96455953260890977068959553820198199624", "140230201503450818024476723512408406564", "7145919838560446581475917319780354208", "109405594789596043724473009359903054006", "208543861014975378628340521836993288628", "214241911440062925668613920728434439342", "157831368993063530271240779107784899911", "179122956903572561039772975887837136347", "169291628659656215095523778620993742299", "76145285988752769522811879006058435872", "216698286285820199523426823288555281039", "273645741751394518673136531657883770"], "threshold":0.9}, "id":"ASB-A-504573577-427e7c7f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/47b53f56d755c6dad4485f47ac1991617bbe13c0", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c8e476407e6c72f646d533af5efbdb71032363b2"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"279526845057031064590492993060815488850", "length":1479}, "id":"ASB-A-504573577-b142ce2b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c8e476407e6c72f646d533af5efbdb71032363b2", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"getManageSpaceActivityIntent"}}, {"deprecated":false, "digest":{"line_hashes":["117736704502356082521070447074097171566", "125490234255071380010985167478587616428", "277036211260624291437348441131050707540", "108123094975113222445742627900357428163", "290842726704363660897265829702452085264", "26268570484225686648971501738192220785", "14411765041829276630199275769454745808", "336025351691242334738892371564604563998", "194341022521932644254444767754294751258", "219036716359787749560571810779249817910", "175234704493882289032039541917827817873", "96455953260890977068959553820198199624", "140230201503450818024476723512408406564", "7145919838560446581475917319780354208", "109405594789596043724473009359903054006", "208543861014975378628340521836993288628", "214241911440062925668613920728434439342", "157831368993063530271240779107784899911", "179122956903572561039772975887837136347", "169291628659656215095523778620993742299", "76145285988752769522811879006058435872", "216698286285820199523426823288555281039", "273645741751394518673136531657883770"], "threshold":0.9}, "id":"ASB-A-504573577-d8cc79ab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c8e476407e6c72f646d533af5efbdb71032363b2", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/20f2dfd9404912b78036823cc56e392031e5846d"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"205252167446257727346328416984313230428", "length":1537}, "id":"ASB-A-504573577-344b1461", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/20f2dfd9404912b78036823cc56e392031e5846d", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"getManageSpaceActivityIntent"}}, {"deprecated":false, "digest":{"line_hashes":["117736704502356082521070447074097171566", "125490234255071380010985167478587616428", "32294471679903276015822303206198258448", "260195633351507410969188211581959614743", "110840983427967077748798182639788265417", "41023389055900421361787190169380042586", "117240276386761738484583127818131850446", "14411765041829276630199275769454745808", "336025351691242334738892371564604563998", "194341022521932644254444767754294751258", "219036716359787749560571810779249817910", "175234704493882289032039541917827817873", "96455953260890977068959553820198199624", "140230201503450818024476723512408406564", "7145919838560446581475917319780354208", "109405594789596043724473009359903054006", "208543861014975378628340521836993288628", "214241911440062925668613920728434439342", "157831368993063530271240779107784899911", "179122956903572561039772975887837136347", "169291628659656215095523778620993742299", "76145285988752769522811879006058435872", "216698286285820199523426823288555281039", "273645741751394518673136531657883770"], "threshold":0.9}, "id":"ASB-A-504573577-cc1f29c9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/20f2dfd9404912b78036823cc56e392031e5846d", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/17874b9db7d3c69ce89fdf5bb5ee778fe3c19d6a"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["117736704502356082521070447074097171566", "125490234255071380010985167478587616428", "32294471679903276015822303206198258448", "260195633351507410969188211581959614743", "110840983427967077748798182639788265417", "41023389055900421361787190169380042586", "117240276386761738484583127818131850446", "14411765041829276630199275769454745808", "336025351691242334738892371564604563998", "194341022521932644254444767754294751258", "219036716359787749560571810779249817910", "175234704493882289032039541917827817873", "96455953260890977068959553820198199624", "140230201503450818024476723512408406564", "7145919838560446581475917319780354208", "109405594789596043724473009359903054006", "208543861014975378628340521836993288628", "214241911440062925668613920728434439342", "157831368993063530271240779107784899911", "179122956903572561039772975887837136347", "169291628659656215095523778620993742299", "76145285988752769522811879006058435872", "216698286285820199523426823288555281039", "273645741751394518673136531657883770"], "threshold":0.9}, "id":"ASB-A-504573577-081b8036", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/17874b9db7d3c69ce89fdf5bb5ee778fe3c19d6a", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"205252167446257727346328416984313230428", "length":1537}, "id":"ASB-A-504573577-5ceefc2e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/17874b9db7d3c69ce89fdf5bb5ee778fe3c19d6a", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"getManageSpaceActivityIntent"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/50d6b5520df2ffe73f2bd5f5ee7265c52a0cee9e"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["117736704502356082521070447074097171566", "125490234255071380010985167478587616428", "32294471679903276015822303206198258448", "260195633351507410969188211581959614743", "110840983427967077748798182639788265417", "41023389055900421361787190169380042586", "117240276386761738484583127818131850446", "14411765041829276630199275769454745808", "336025351691242334738892371564604563998", "194341022521932644254444767754294751258", "219036716359787749560571810779249817910", "175234704493882289032039541917827817873", "96455953260890977068959553820198199624", "140230201503450818024476723512408406564", "7145919838560446581475917319780354208", "109405594789596043724473009359903054006", "208543861014975378628340521836993288628", "214241911440062925668613920728434439342", "157831368993063530271240779107784899911", "179122956903572561039772975887837136347", "169291628659656215095523778620993742299", "76145285988752769522811879006058435872", "216698286285820199523426823288555281039", "273645741751394518673136531657883770"], "threshold":0.9}, "id":"ASB-A-504573577-31beb0cf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/50d6b5520df2ffe73f2bd5f5ee7265c52a0cee9e", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"205252167446257727346328416984313230428", "length":1537}, "id":"ASB-A-504573577-f4ece579", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/50d6b5520df2ffe73f2bd5f5ee7265c52a0cee9e", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"getManageSpaceActivityIntent"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/31a9b539ed511c875fb470d09a2eda9c4b4874d0"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["117736704502356082521070447074097171566", "125490234255071380010985167478587616428", "277036211260624291437348441131050707540", "108123094975113222445742627900357428163", "290842726704363660897265829702452085264", "26268570484225686648971501738192220785", "14411765041829276630199275769454745808", "336025351691242334738892371564604563998", "194341022521932644254444767754294751258", "219036716359787749560571810779249817910", "175234704493882289032039541917827817873", "96455953260890977068959553820198199624", "140230201503450818024476723512408406564", "7145919838560446581475917319780354208", "109405594789596043724473009359903054006", "208543861014975378628340521836993288628", "214241911440062925668613920728434439342", "157831368993063530271240779107784899911", "179122956903572561039772975887837136347", "169291628659656215095523778620993742299", "76145285988752769522811879006058435872", "216698286285820199523426823288555281039", "273645741751394518673136531657883770"], "threshold":0.9}, "id":"ASB-A-504573577-2c1c93ca", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/31a9b539ed511c875fb470d09a2eda9c4b4874d0", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"279526845057031064590492993060815488850", "length":1479}, "id":"ASB-A-504573577-c817cfca", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/31a9b539ed511c875fb470d09a2eda9c4b4874d0", "target":{"file":"services/core/java/com/android/server/StorageManagerService.java", "function":"getManageSpaceActivityIntent"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}