{"id":"ASB-A-505067993", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-55262", "A-505067993"], "details":"In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible  policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/577543980a006ea56dd3fbbb3e7e4d28bb0db4d8"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"177451627907547070523621252875831939662", "length":1194}, "id":"ASB-A-505067993-9c28fe93", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/577543980a006ea56dd3fbbb3e7e4d28bb0db4d8", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"setNotificationListenerAccessGrantedForUserInternal"}}, {"deprecated":false, "digest":{"line_hashes":["278745691919809360854153693686274713946", "185656938617667471664028572188051753629", "75978779350078412707991368963067374126", "99814645763464290913885771135164226616"], "threshold":0.9}, "id":"ASB-A-505067993-ccdacbd3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/577543980a006ea56dd3fbbb3e7e4d28bb0db4d8", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e844e46351d53ae6f8fb8d35dbfeb0677dc0dbf1"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["146242436295012419806337339958866653161", "185656938617667471664028572188051753629", "75978779350078412707991368963067374126", "99814645763464290913885771135164226616"], "threshold":0.9}, "id":"ASB-A-505067993-107bb783", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e844e46351d53ae6f8fb8d35dbfeb0677dc0dbf1", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"148352648110322003019128251639532073655", "length":1225}, "id":"ASB-A-505067993-1a3132b0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e844e46351d53ae6f8fb8d35dbfeb0677dc0dbf1", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"setNotificationListenerAccessGrantedForUser"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/80bee43622e6cf8ee89fe36a721350a0a089a9e2"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"240138501262676182444508959647016007451", "length":1296}, "id":"ASB-A-505067993-1856ca32", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/80bee43622e6cf8ee89fe36a721350a0a089a9e2", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"setNotificationListenerAccessGrantedForUser"}}, {"deprecated":false, "digest":{"line_hashes":["278745691919809360854153693686274713946", "185656938617667471664028572188051753629", "75978779350078412707991368963067374126", "99814645763464290913885771135164226616"], "threshold":0.9}, "id":"ASB-A-505067993-a4f5b5f1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/80bee43622e6cf8ee89fe36a721350a0a089a9e2", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fd35fa62637c5cb2575996326b44ee9a19bbb2fa"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["278745691919809360854153693686274713946", "185656938617667471664028572188051753629", "75978779350078412707991368963067374126", "99814645763464290913885771135164226616"], "threshold":0.9}, "id":"ASB-A-505067993-bc5ec9be", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fd35fa62637c5cb2575996326b44ee9a19bbb2fa", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"98514933952219307677968431208261814333", "length":1330}, "id":"ASB-A-505067993-d991266a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/fd35fa62637c5cb2575996326b44ee9a19bbb2fa", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"setNotificationListenerAccessGrantedForUser"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a6fc2d471a7529428330e9fbf2de5866fd449aef"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["278745691919809360854153693686274713946", "185656938617667471664028572188051753629", "75978779350078412707991368963067374126", "99814645763464290913885771135164226616"], "threshold":0.9}, "id":"ASB-A-505067993-17786064", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a6fc2d471a7529428330e9fbf2de5866fd449aef", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"157790974212425174168279966275364715533", "length":1101}, "id":"ASB-A-505067993-8579841b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a6fc2d471a7529428330e9fbf2de5866fd449aef", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"setNotificationListenerAccessGrantedForUserInternal"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1fe8763f3c9f71e0b752cbcfd0d907b8770ad3eb"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["82626712534338495975921566045102088679", "116201476102771282999750737566044312877", "75978779350078412707991368963067374126", "99814645763464290913885771135164226616"], "threshold":0.9}, "id":"ASB-A-505067993-7371f75d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1fe8763f3c9f71e0b752cbcfd0d907b8770ad3eb", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"89373110465803920719114809462447913870", "length":1019}, "id":"ASB-A-505067993-d3572bc9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1fe8763f3c9f71e0b752cbcfd0d907b8770ad3eb", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"setNotificationListenerAccessGrantedForUser"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}