{"id":"ASB-A-517377154", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-05T16:20:22.411518700Z", "aliases":["CVE-2026-55270", "A-517377154"], "details":"In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"221394791022293154273777459030637463810", "length":1700}, "id":"ASB-A-517377154-290421eb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java", "function":"dialInternal"}}, {"deprecated":false, "digest":{"line_hashes":["85564889611049434015439836351970671330", "321032152181963527884525531471844641270", "3432312994283051198705360490823037384", "26180908986988205332850313313899922389", "215467192842611058928262666195218348653", "88284407523653103560900716683235967625", "298661402963263501180526436452982816388", "296798653215701405775789907848957976896", "292903738859645515677839881079245263014"], "threshold":0.9}, "id":"ASB-A-517377154-7663ce10", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"}}, {"deprecated":false, "digest":{"function_hash":"201191755801169938559793686686857451416", "length":931}, "id":"ASB-A-517377154-92d426e8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java", "function":"dialInternal"}}, {"deprecated":false, "digest":{"line_hashes":["277581113841276915046506624877618589123", "26807683584315311557738686723874494849", "180113764066743593245372552958971069287", "125563055740235136696996883584854084164"], "threshold":0.9}, "id":"ASB-A-517377154-d5bd7508", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-10-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"6305359641223191727483443275289539815", "length":822}, "id":"ASB-A-517377154-5924e594", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java", "function":"dialInternal"}}, {"deprecated":false, "digest":{"line_hashes":["276486398894243870858939285016085180769", "331130644673552391344038389965615968271", "196359260725455957277826842540430308842", "228067325901179876767365283075649691739"], "threshold":0.9}, "id":"ASB-A-517377154-6daeb922", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"}}, {"deprecated":false, "digest":{"function_hash":"251213840187113905346480696010844682837", "length":1304}, "id":"ASB-A-517377154-7d810d39", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java", "function":"dialInternal"}}, {"deprecated":false, "digest":{"line_hashes":["149153288427063021861143638119183404026", "100665003626303544326226369782043996662", "60715967235166955707373939140397294650", "336219546894114884852735354772127773921"], "threshold":0.9}, "id":"ASB-A-517377154-b48d2834", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["174077472406464759824351320962334433947", "325562207689985291227948377045572501240", "134326709048462993827154183361924573471", "304998092329951519773749479357793624221", "338009389495854147057311071991689450413", "110355204068176469511525399724419046930", "161711783838440220482376833713856559904", "90946821917742786583255147253775975404"], "threshold":0.9}, "id":"ASB-A-517377154-1abd6d05", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"}}, {"deprecated":false, "digest":{"function_hash":"317438603624160635743171545201367024942", "length":938}, "id":"ASB-A-517377154-700b08c2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java", "function":"dialInternal"}}, {"deprecated":false, "digest":{"line_hashes":["156032670633742517260113234718591625572", "171455528062073778619381724172853253549", "134326709048462993827154183361924573471", "304998092329951519773749479357793624221", "338009389495854147057311071991689450413", "110355204068176469511525399724419046930", "161711783838440220482376833713856559904", "90946821917742786583255147253775975404"], "threshold":0.9}, "id":"ASB-A-517377154-864916d6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"}}, {"deprecated":false, "digest":{"function_hash":"40809998033970267222727927159235444304", "length":1634}, "id":"ASB-A-517377154-e0919ec2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java", "function":"dialInternal"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["237927818888720316944931895446297837050", "59836574792446009165025135316108749894", "128839134679662729639640806331666225701", "337071243829700196987641404901216088952"], "threshold":0.9}, "id":"ASB-A-517377154-329f220f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"}}, {"deprecated":false, "digest":{"function_hash":"285767272394866841301906938934138203699", "length":1537}, "id":"ASB-A-517377154-46ebd872", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java", "function":"dialInternal"}}, {"deprecated":false, "digest":{"line_hashes":["6481862458218090228218788075869645289", "115463448771535689218673312633010310118", "128839134679662729639640806331666225701", "27394729640458959225443737895051313693"], "threshold":0.9}, "id":"ASB-A-517377154-77e7610a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"}}, {"deprecated":false, "digest":{"function_hash":"72497289640835833960216901968607590254", "length":774}, "id":"ASB-A-517377154-b3f1c5a5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java", "function":"dialInternal"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["88284407523653103560900716683235967625", "298661402963263501180526436452982816388", "296798653215701405775789907848957976896", "292903738859645515677839881079245263014"], "threshold":0.9}, "id":"ASB-A-517377154-4a6f2b8d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"}}, {"deprecated":false, "digest":{"function_hash":"221394791022293154273777459030637463810", "length":1700}, "id":"ASB-A-517377154-5fd5c6ae", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java", "function":"dialInternal"}}, {"deprecated":false, "digest":{"function_hash":"201191755801169938559793686686857451416", "length":931}, "id":"ASB-A-517377154-ad12e3f6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java", "function":"dialInternal"}}, {"deprecated":false, "digest":{"line_hashes":["277581113841276915046506624877618589123", "26807683584315311557738686723874494849", "180113764066743593245372552958971069287", "125563055740235136696996883584854084164"], "threshold":0.9}, "id":"ASB-A-517377154-d6fda682", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"}}]}}, {"package":{"name":"platform/frameworks/opt/telephony", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-10-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de"], "severity":"High", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"251213840187113905346480696010844682837", "length":1304}, "id":"ASB-A-517377154-33711728", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java", "function":"dialInternal"}}, {"deprecated":false, "digest":{"line_hashes":["276486398894243870858939285016085180769", "331130644673552391344038389965615968271", "196359260725455957277826842540430308842", "228067325901179876767365283075649691739"], "threshold":0.9}, "id":"ASB-A-517377154-526af996", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java"}}, {"deprecated":false, "digest":{"line_hashes":["149153288427063021861143638119183404026", "100665003626303544326226369782043996662", "60715967235166955707373939140397294650", "336219546894114884852735354772127773921"], "threshold":0.9}, "id":"ASB-A-517377154-7117f3c9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de", "target":{"file":"src/java/com/android/internal/telephony/imsphone/ImsPhone.java"}}, {"deprecated":false, "digest":{"function_hash":"6305359641223191727483443275289539815", "length":822}, "id":"ASB-A-517377154-a01b9dad", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de", "target":{"file":"src/java/com/android/internal/telephony/GsmCdmaPhone.java", "function":"dialInternal"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}