{"id":"ASB-A-527034642", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58946", "A-527034642"], "details":"In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["66626885679975416344591914439836620015", "298236227127430811248567657295975947972", "120841021482464668877120412446517404938"], "threshold":0.9}, "id":"ASB-A-527034642-0721f6b5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"}}, {"deprecated":false, "digest":{"function_hash":"277225765274953645649780085194809424659", "length":563}, "id":"ASB-A-527034642-3a6995d0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java", "function":"navigateUpTo"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/251949ef9f045abc67c169dd0cceb076ad9d9c7e"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["308109601750817782096252523506789553926", "332618966041723367115481096434693326044", "252549206848878189123090693328808540697"], "threshold":0.9}, "id":"ASB-A-527034642-bd6b877f", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/251949ef9f045abc67c169dd0cceb076ad9d9c7e", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"}}, {"deprecated":false, "digest":{"function_hash":"243161130442187690972303800278616305359", "length":461}, "id":"ASB-A-527034642-e7e2da49", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/251949ef9f045abc67c169dd0cceb076ad9d9c7e", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java", "function":"navigateUpTo"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/072555e9730d029a38a72128be46831889dc426e"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"243161130442187690972303800278616305359", "length":461}, "id":"ASB-A-527034642-7f36e996", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/072555e9730d029a38a72128be46831889dc426e", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java", "function":"navigateUpTo"}}, {"deprecated":false, "digest":{"line_hashes":["308109601750817782096252523506789553926", "332618966041723367115481096434693326044", "252549206848878189123090693328808540697"], "threshold":0.9}, "id":"ASB-A-527034642-c3c6f547", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/072555e9730d029a38a72128be46831889dc426e", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9315367cd50d1e5434efd4a818193322f915f210"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["308109601750817782096252523506789553926", "332618966041723367115481096434693326044", "252549206848878189123090693328808540697"], "threshold":0.9}, "id":"ASB-A-527034642-6348d546", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9315367cd50d1e5434efd4a818193322f915f210", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"}}, {"deprecated":false, "digest":{"function_hash":"243161130442187690972303800278616305359", "length":461}, "id":"ASB-A-527034642-93aa435a", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9315367cd50d1e5434efd4a818193322f915f210", "target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java", "function":"navigateUpTo"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}