{"id":"ASB-A-505203996", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-55289", "A-505203996"], "details":"In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"330315130932522360784747181487816530920", "length":287}, "id":"ASB-A-505203996-1ed81ab6", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java", "function":"isPrivilegedDialerCalling"}}, {"deprecated":false, "digest":{"function_hash":"295712094137804635205810278931496000458", "length":407}, "id":"ASB-A-505203996-33e80638", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java", "function":"canCallPhone"}}, {"deprecated":false, "digest":{"line_hashes":["86278727861197139604671893229060424621", "103766434882346259814728050165405437505", "234504008221683615009177537819868366400", "92515587208316795308991249841478771306", "69716668344983655770162293817504341487", "48416785219082061250808708873163493378", "45650031370359766663826475779683718154", "142987263936802276706160726272810418353", "193628616257204987446523787817527616332", "309369494472123450681838919540963304045", "218369141499899838781240123060173072054", "6249721980892984414849712123497377303", "243536576043052723022382113460783169736", "80451506911237754867416745900263328170", "80724333720435303056576763340845266400", "319011713610100120864939992360009683939", "12001071865962451999073060072627413515", "257658228199479444816923161032889276286", "35240001829098591109843888949307083210"], "threshold":0.9}, "id":"ASB-A-505203996-42c8c6bc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"shim/src/com/android/server/telecom/components/UserCallActivity.java"}}, {"deprecated":false, "digest":{"line_hashes":["50695453196511917667382222915167439542", "272086397273914182336634860434661176822", "200698477459139337055977027095292128212", "90141269349917598685359379552506181967"], "threshold":0.9}, "id":"ASB-A-505203996-5eaf0ae2", "match_only_versions":["17-qpr2-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java"}}, {"deprecated":false, "digest":{"function_hash":"323176036711350709855376518473680491912", "length":3395}, "id":"ASB-A-505203996-6b4848cb", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java", "function":"evaluateCall"}}, {"deprecated":false, "digest":{"function_hash":"331385506515775265558732758139538512725", "length":513}, "id":"ASB-A-505203996-6f782566", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["174158765299844124862182486439794315587", "294865490144327236354505462175307729585", "154701552172875255828056385180029400413", "282100032885274639554194341970058983963", "171124136203903482151304339303388538750", "212198880264034643598445223044439501437", "206458414995876812280768179639101306925", "329391719045896626815104727658732290078", "252716857351176541831830684124242156724", "223353076577811774688916603567421288556", "334003929268480117611375380446140343729", "226454840075806144798465516219575123924", "291169693121892326246353889426833768395", "184026378660447282904299984341827822005", "142878841133625634987164990152496923377", "199398547060826680043193663774472747630", "335648399029946842055827149653375901290", "106819061933740884976984181160246624859", "213651187607373246609274529685428814716", "141391334662881615769053942429005152198", "250052718377858165254528258080305220096", "281299525101955639516243683589380377121", "126470771980775024067872490708988041849", "108587633537507210242609878158511307392"], "threshold":0.9}, "id":"ASB-A-505203996-774663b4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"240605221182393886588539899514619758048", "length":402}, "id":"ASB-A-505203996-b5ae9364", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"shim/src/com/android/server/telecom/components/UserCallActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["211606276810484770850335400062363720648", "208029519138830534075153600342797647095", "49910670201577065668438323373258281225", "212449657643427366064019303224402410465", "200433922445479970685364476649083516722", "37466961728406674403279944156737363576", "128040321331304509027012639690330862672", "84665339305936974132918708462822274898", "198653903060236862370455849760178000090", "267780876264562307033453634237472480254", "245002908388018266800826644200589145972", "151166777004075194442125827304301777280", "226138919854692382020361725630530615925", "306064304924570502954231156251315144581", "123787832335589096071169277345227123243", "43163942321134570520094006480075930320", "231062644332274203393143252018489583210", "65900374074704959880361816702164331516", "1940933418998956496677517011395907334", "290257482944060423318858568018666373918", "42861667117885092653915698266671293744", "325237034809324114931913038604212543510", "42687180638943089901085023415870552346", "229091512329938673298048244250437767090", "39437940744165216598041809419395730966", "49972917257305688207505237252462705470", "168846663661885879776292167690822831118", "19942330904931449819666157497822824989", "5352145155968974949146155114994691872", "71213782818208411621331524956476590892", "74125085547040839270481520649481066054", "216759101321050414572302443584326964221", "313716507106706704845400636629083467301", "115700971515451193416402783396439007461", "1100794366951065722690305627346689872", "334910930580624831346148765740764517425", "205207896246053102986634230757109838338", "74641304081934351207167371350069938556", "335777800183651497369059224788356919682", "172310961955298760571850989084888564608", "167440586512384540725453599750191482598", "101065513537398550422398073860005781861", "132358025902736832135776783458677104372", "23223460542096636811488640541404017453", "175898472054875948418032079417714943765", "240038912123859328756881310510379930081", "230596331461920213185110415673702975716", "262349375935787992936486003242721178693", "42008630169433739829497722439383527278", "214970976169313070613719100687100639671", "202557024206086899536646162163561932232", "237962361949789119224438660020119595466", "28596955379224888003298913676426171137", "237373438958482878177039912373166182267", "45822501124873862512616495515827442413", "335943456201435223554115798408444771743", "105629498571838687917492431227196817296", "124133484266256358898672596735952455270", "332440396655864344600237596462501881406", "170861106833961075340615141014447051417", "100295546031401840307877216740584035038"], "threshold":0.9}, "id":"ASB-A-505203996-d1b104c2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"71842551649817028901445745690455959475", "length":2199}, "id":"ASB-A-505203996-f6fff2ef", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/4da877f49ae09a3194e4e2481d4b97266cff9634", "target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java", "function":"placeCall"}}]}}, {"package":{"name":"platform/packages/services/Telecomm", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"71842551649817028901445745690455959475", "length":2199}, "id":"ASB-A-505203996-003ce308", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java", "function":"placeCall"}}, {"deprecated":false, "digest":{"line_hashes":["252716857351176541831830684124242156724", "223353076577811774688916603567421288556", "334003929268480117611375380446140343729", "226454840075806144798465516219575123924", "199398547060826680043193663774472747630", "335648399029946842055827149653375901290", "106819061933740884976984181160246624859", "213651187607373246609274529685428814716", "141391334662881615769053942429005152198", "250052718377858165254528258080305220096", "281299525101955639516243683589380377121", "126470771980775024067872490708988041849", "108587633537507210242609878158511307392"], "threshold":0.9}, "id":"ASB-A-505203996-11bb61aa", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"1191534197891038414758743629728348917", "length":91}, "id":"ASB-A-505203996-2e9c78e0", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java", "function":"canCallPhone"}}, {"deprecated":false, "digest":{"line_hashes":["50695453196511917667382222915167439542", "272086397273914182336634860434661176822", "200698477459139337055977027095292128212", "90141269349917598685359379552506181967"], "threshold":0.9}, "id":"ASB-A-505203996-61018b70", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java"}}, {"deprecated":false, "digest":{"line_hashes":["92515587208316795308991249841478771306", "69716668344983655770162293817504341487", "48416785219082061250808708873163493378", "243536576043052723022382113460783169736", "80451506911237754867416745900263328170", "80724333720435303056576763340845266400", "319011713610100120864939992360009683939"], "threshold":0.9}, "id":"ASB-A-505203996-6f1231cf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"shim/src/com/android/server/telecom/components/UserCallActivity.java"}}, {"deprecated":false, "digest":{"function_hash":"331385506515775265558732758139538512725", "length":513}, "id":"ASB-A-505203996-715dfc7e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"function_hash":"240605221182393886588539899514619758048", "length":402}, "id":"ASB-A-505203996-79e1e6cd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"shim/src/com/android/server/telecom/components/UserCallActivity.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"function_hash":"330315130932522360784747181487816530920", "length":287}, "id":"ASB-A-505203996-8bd22a5e", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java", "function":"isPrivilegedDialerCalling"}}, {"deprecated":false, "digest":{"function_hash":"323176036711350709855376518473680491912", "length":3395}, "id":"ASB-A-505203996-c12aefd4", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"src/com/android/server/telecom/NewOutgoingCallIntentBroadcaster.java", "function":"evaluateCall"}}, {"deprecated":false, "digest":{"line_hashes":["200433922445479970685364476649083516722", "37466961728406674403279944156737363576", "128040321331304509027012639690330862672", "84665339305936974132918708462822274898", "198653903060236862370455849760178000090", "267780876264562307033453634237472480254", "65900374074704959880361816702164331516", "1940933418998956496677517011395907334", "290257482944060423318858568018666373918", "42861667117885092653915698266671293744", "325237034809324114931913038604212543510", "42687180638943089901085023415870552346", "229091512329938673298048244250437767090", "39437940744165216598041809419395730966", "49972917257305688207505237252462705470", "168846663661885879776292167690822831118", "19942330904931449819666157497822824989", "5352145155968974949146155114994691872", "71213782818208411621331524956476590892", "74125085547040839270481520649481066054", "216759101321050414572302443584326964221", "313716507106706704845400636629083467301", "115700971515451193416402783396439007461", "1100794366951065722690305627346689872", "334910930580624831346148765740764517425", "205207896246053102986634230757109838338", "74641304081934351207167371350069938556", "335777800183651497369059224788356919682", "172310961955298760571850989084888564608", "167440586512384540725453599750191482598", "101065513537398550422398073860005781861", "132358025902736832135776783458677104372", "13185319101264593172080308982356280931", "143606030375037241194193185918268659158", "311557270563434180769956070890341126138", "23223460542096636811488640541404017453", "175898472054875948418032079417714943765", "240038912123859328756881310510379930081", "230596331461920213185110415673702975716", "262349375935787992936486003242721178693", "42008630169433739829497722439383527278", "214970976169313070613719100687100639671", "202557024206086899536646162163561932232", "237962361949789119224438660020119595466", "28596955379224888003298913676426171137", "237373438958482878177039912373166182267", "45822501124873862512616495515827442413", "105629498571838687917492431227196817296", "124133484266256358898672596735952455270", "332440396655864344600237596462501881406", "170861106833961075340615141014447051417", "100295546031401840307877216740584035038"], "threshold":0.9}, "id":"ASB-A-505203996-cdb7475c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java"}}, {"deprecated":false, "digest":{"function_hash":"295712094137804635205810278931496000458", "length":407}, "id":"ASB-A-505203996-d5d49f3f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"src/com/android/server/telecom/TelecomServiceImpl.java", "function":"canCallPhone"}}, {"deprecated":false, "digest":{"function_hash":"297037854016735136514187153206101819123", "length":317}, "id":"ASB-A-505203996-e92e0ac4", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/services/Telecomm/+/34046226fb2964d944669a990128ab9e3d00615b", "target":{"file":"TelecomUi/src/com/android/server/telecomui/components/UserCallActivity.java", "function":"verifyCallAction"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}