{"id":"ASB-A-507575871", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28658", "A-507575871"], "details":"In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6a2d8b6bc382fa5dc845650d3a47176efa0ef554"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"214884600998675636459233104184776894002", "length":835}, "id":"ASB-A-507575871-25750707", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6a2d8b6bc382fa5dc845650d3a47176efa0ef554", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java", "function":"findMetaAuthUid"}}, {"deprecated":false, "digest":{"line_hashes":["145846812891764339617439909658596855819", "36247804971271176721404609721789626033", "309472771607039647252752725677737594933", "188687346634811302480631272334728679162", "48560736277134926536525914687556358538", "329534993615049278268322453974420969707", "100438875036151586299867983787764500487", "73898767245209920450383611738606157548", "71044382201136563276894606252199556150"], "threshold":0.9}, "id":"ASB-A-507575871-61d076c6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6a2d8b6bc382fa5dc845650d3a47176efa0ef554", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9d93fc6dc1a4c4e71c6be4423e002934500fcc4f"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["145846812891764339617439909658596855819", "36247804971271176721404609721789626033", "309472771607039647252752725677737594933", "105184994290666824993970154764502399744", "48560736277134926536525914687556358538", "329534993615049278268322453974420969707", "100438875036151586299867983787764500487", "73898767245209920450383611738606157548", "71044382201136563276894606252199556150"], "threshold":0.9}, "id":"ASB-A-507575871-64a8dd60", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9d93fc6dc1a4c4e71c6be4423e002934500fcc4f", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"}}, {"deprecated":false, "digest":{"function_hash":"214884600998675636459233104184776894002", "length":835}, "id":"ASB-A-507575871-aa9ad87e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9d93fc6dc1a4c4e71c6be4423e002934500fcc4f", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java", "function":"findMetaAuthUid"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/67c5dd4a7a88112d1b4b6b813a8f53a17c24f46d"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["145846812891764339617439909658596855819", "36247804971271176721404609721789626033", "309472771607039647252752725677737594933", "105184994290666824993970154764502399744", "48560736277134926536525914687556358538", "329534993615049278268322453974420969707", "100438875036151586299867983787764500487", "73898767245209920450383611738606157548", "71044382201136563276894606252199556150"], "threshold":0.9}, "id":"ASB-A-507575871-d4003a6d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/67c5dd4a7a88112d1b4b6b813a8f53a17c24f46d", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"}}, {"deprecated":false, "digest":{"function_hash":"214884600998675636459233104184776894002", "length":835}, "id":"ASB-A-507575871-ff97668c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/67c5dd4a7a88112d1b4b6b813a8f53a17c24f46d", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java", "function":"findMetaAuthUid"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cb21bacf45ab1077423520552ea2969071f5fd28"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"214884600998675636459233104184776894002", "length":835}, "id":"ASB-A-507575871-3dd81ad3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cb21bacf45ab1077423520552ea2969071f5fd28", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java", "function":"findMetaAuthUid"}}, {"deprecated":false, "digest":{"line_hashes":["145846812891764339617439909658596855819", "36247804971271176721404609721789626033", "309472771607039647252752725677737594933", "105184994290666824993970154764502399744", "48560736277134926536525914687556358538", "329534993615049278268322453974420969707", "100438875036151586299867983787764500487", "73898767245209920450383611738606157548", "71044382201136563276894606252199556150"], "threshold":0.9}, "id":"ASB-A-507575871-d6eaea11", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cb21bacf45ab1077423520552ea2969071f5fd28", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b8d9ce94c8ba0a10cc105655ce5bffca415f098c"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["145846812891764339617439909658596855819", "36247804971271176721404609721789626033", "309472771607039647252752725677737594933", "188687346634811302480631272334728679162", "48560736277134926536525914687556358538", "329534993615049278268322453974420969707", "100438875036151586299867983787764500487", "73898767245209920450383611738606157548", "71044382201136563276894606252199556150"], "threshold":0.9}, "id":"ASB-A-507575871-552efad2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b8d9ce94c8ba0a10cc105655ce5bffca415f098c", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"}}, {"deprecated":false, "digest":{"function_hash":"214884600998675636459233104184776894002", "length":835}, "id":"ASB-A-507575871-d4adafd7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b8d9ce94c8ba0a10cc105655ce5bffca415f098c", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java", "function":"findMetaAuthUid"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ea8f06108405df08d3a1615c92bc71b5d6889781"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["145846812891764339617439909658596855819", "36247804971271176721404609721789626033", "309472771607039647252752725677737594933", "105184994290666824993970154764502399744", "48560736277134926536525914687556358538", "329534993615049278268322453974420969707", "100438875036151586299867983787764500487", "73898767245209920450383611738606157548", "71044382201136563276894606252199556150"], "threshold":0.9}, "id":"ASB-A-507575871-207f3ef5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ea8f06108405df08d3a1615c92bc71b5d6889781", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java"}}, {"deprecated":false, "digest":{"function_hash":"214884600998675636459233104184776894002", "length":835}, "id":"ASB-A-507575871-dd68d363", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ea8f06108405df08d3a1615c92bc71b5d6889781", "target":{"file":"services/core/java/com/android/server/accounts/AccountsDb.java", "function":"findMetaAuthUid"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}