{"id":"ASB-A-504612754", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-49922", "A-504612754"], "details":"In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/f93b1e37858cc84d29e9daa57fca0d5ff8fd718d"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"245119199649126703861091156142162242281", "length":537}, "id":"ASB-A-504612754-95293d79", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f93b1e37858cc84d29e9daa57fca0d5ff8fd718d", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java", "function":"queryRemoteConnectionServices"}}, {"deprecated":false, "digest":{"line_hashes":["116351678834445701071206380721420582045", "302353530985646201335380535951438213695", "336381818691306038010298984721682917413", "161959456169685061143431771943308818010", "101092358744341137725637525002484405961", "278503811038784378973619098949731536652", "55176005618510562308711840013890613482", "241788340531073202913362132520032900514", "68731918390243616678815821875892029651", "68851936220059559151446500334615042661", "260091009424696413441674874825254923617", "72841479537362505861685449768186199528", "113932742328212654938945691421138723194", "284341452863539510134188980953020955233", "322253896263715952330722050898299726309", "181570424070791967675635095282325525041", "300317465410289060595603556668785015337", "26793227614976471429784599192076533669"], "threshold":0.9}, "id":"ASB-A-504612754-caa3666c", "match_only_versions":["17-qpr2-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/f93b1e37858cc84d29e9daa57fca0d5ff8fd718d", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"}}]}}, {"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/6557e81b57511166ac0b4352804f5316307dd2f2"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"245119199649126703861091156142162242281", "length":537}, "id":"ASB-A-504612754-4600c31a", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6557e81b57511166ac0b4352804f5316307dd2f2", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java", "function":"queryRemoteConnectionServices"}}, {"deprecated":false, "digest":{"line_hashes":["116351678834445701071206380721420582045", "302353530985646201335380535951438213695", "336381818691306038010298984721682917413", "161959456169685061143431771943308818010", "101092358744341137725637525002484405961", "278503811038784378973619098949731536652", "55176005618510562308711840013890613482", "241788340531073202913362132520032900514", "68731918390243616678815821875892029651", "68851936220059559151446500334615042661", "260091009424696413441674874825254923617", "72841479537362505861685449768186199528", "113932742328212654938945691421138723194", "284341452863539510134188980953020955233", "322253896263715952330722050898299726309", "181570424070791967675635095282325525041", "300317465410289060595603556668785015337", "26793227614976471429784599192076533669"], "threshold":0.9}, "id":"ASB-A-504612754-b87e55b7", "match_only_versions":["15"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/6557e81b57511166ac0b4352804f5316307dd2f2", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"}}]}}, {"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/260368fb70638d1f23fe1668264d6b8ffec2f1c1"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["116351678834445701071206380721420582045", "302353530985646201335380535951438213695", "336381818691306038010298984721682917413", "161959456169685061143431771943308818010", "101092358744341137725637525002484405961", "278503811038784378973619098949731536652", "55176005618510562308711840013890613482", "241788340531073202913362132520032900514", "68731918390243616678815821875892029651", "68851936220059559151446500334615042661", "260091009424696413441674874825254923617", "72841479537362505861685449768186199528", "113932742328212654938945691421138723194", "284341452863539510134188980953020955233", "322253896263715952330722050898299726309", "181570424070791967675635095282325525041", "300317465410289060595603556668785015337", "26793227614976471429784599192076533669"], "threshold":0.9}, "id":"ASB-A-504612754-62809b18", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/260368fb70638d1f23fe1668264d6b8ffec2f1c1", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"}}, {"deprecated":false, "digest":{"function_hash":"245119199649126703861091156142162242281", "length":537}, "id":"ASB-A-504612754-ba9ccc85", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/260368fb70638d1f23fe1668264d6b8ffec2f1c1", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java", "function":"queryRemoteConnectionServices"}}]}}, {"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/c07db1c681bb9aa0dfbb0b0263c76a0597f1038f"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["116351678834445701071206380721420582045", "302353530985646201335380535951438213695", "336381818691306038010298984721682917413", "161959456169685061143431771943308818010", "101092358744341137725637525002484405961", "278503811038784378973619098949731536652", "55176005618510562308711840013890613482", "241788340531073202913362132520032900514", "68731918390243616678815821875892029651", "68851936220059559151446500334615042661", "260091009424696413441674874825254923617", "72841479537362505861685449768186199528", "113932742328212654938945691421138723194", "284341452863539510134188980953020955233", "322253896263715952330722050898299726309", "181570424070791967675635095282325525041", "300317465410289060595603556668785015337", "26793227614976471429784599192076533669"], "threshold":0.9}, "id":"ASB-A-504612754-037b234d", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/c07db1c681bb9aa0dfbb0b0263c76a0597f1038f", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"}}, {"deprecated":false, "digest":{"function_hash":"245119199649126703861091156142162242281", "length":537}, "id":"ASB-A-504612754-8868fefc", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/c07db1c681bb9aa0dfbb0b0263c76a0597f1038f", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java", "function":"queryRemoteConnectionServices"}}]}}, {"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/9a75620f4384c2266389c4c06b899e7bae841589"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["116351678834445701071206380721420582045", "302353530985646201335380535951438213695", "336381818691306038010298984721682917413", "161959456169685061143431771943308818010", "101092358744341137725637525002484405961", "278503811038784378973619098949731536652", "55176005618510562308711840013890613482", "241788340531073202913362132520032900514", "68731918390243616678815821875892029651", "68851936220059559151446500334615042661", "260091009424696413441674874825254923617", "72841479537362505861685449768186199528", "113932742328212654938945691421138723194", "284341452863539510134188980953020955233", "322253896263715952330722050898299726309", "181570424070791967675635095282325525041", "300317465410289060595603556668785015337", "26793227614976471429784599192076533669"], "threshold":0.9}, "id":"ASB-A-504612754-a9870013", "match_only_versions":["14"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9a75620f4384c2266389c4c06b899e7bae841589", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java"}}, {"deprecated":false, "digest":{"function_hash":"245119199649126703861091156142162242281", "length":537}, "id":"ASB-A-504612754-b174db36", "match_only_versions":["14"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/9a75620f4384c2266389c4c06b899e7bae841589", "target":{"file":"src/com/android/server/telecom/ConnectionServiceWrapper.java", "function":"queryRemoteConnectionServices"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}