{"id":"ASB-A-527035781", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58962", "A-527035781"], "details":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/12d5de2a0e06beb34abce054ab0e8897135da323"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["62011701134777276986251248852539614540", "92172802454453612133839956802899567819", "224387390911462804685994490359867579533", "330199258119220903441018735575446108565", "255406588669344269331232759051632105725", "36416561039801639012166314874104608982"], "threshold":0.9}, "id":"ASB-A-527035781-23645a5a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/12d5de2a0e06beb34abce054ab0e8897135da323", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"20102728011151154153999897544205216947", "length":1276}, "id":"ASB-A-527035781-23fb83c7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/12d5de2a0e06beb34abce054ab0e8897135da323", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"moveTaskToFrontLocked"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2f47d65518c42eff6e4cf7b6faf7846cc37ac585"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["62011701134777276986251248852539614540", "92172802454453612133839956802899567819", "224387390911462804685994490359867579533", "330199258119220903441018735575446108565", "255406588669344269331232759051632105725", "36416561039801639012166314874104608982"], "threshold":0.9}, "id":"ASB-A-527035781-2aa5177b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/2f47d65518c42eff6e4cf7b6faf7846cc37ac585", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"179853645378831390113868602560305857675", "length":1303}, "id":"ASB-A-527035781-34c753a6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/2f47d65518c42eff6e4cf7b6faf7846cc37ac585", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"moveTaskToFrontLocked"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6bffdca7b65c9dbbb4fdd227a5d260a8a10282f7"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"20102728011151154153999897544205216947", "length":1276}, "id":"ASB-A-527035781-3d1f42d1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6bffdca7b65c9dbbb4fdd227a5d260a8a10282f7", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"moveTaskToFrontLocked"}}, {"deprecated":false, "digest":{"line_hashes":["62011701134777276986251248852539614540", "92172802454453612133839956802899567819", "224387390911462804685994490359867579533", "330199258119220903441018735575446108565", "255406588669344269331232759051632105725", "36416561039801639012166314874104608982"], "threshold":0.9}, "id":"ASB-A-527035781-d405e3e2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6bffdca7b65c9dbbb4fdd227a5d260a8a10282f7", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bf8dfb689b691fd9f45eee45bb2acbe18bf51df9"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["62011701134777276986251248852539614540", "92172802454453612133839956802899567819", "224387390911462804685994490359867579533", "330199258119220903441018735575446108565", "255406588669344269331232759051632105725", "36416561039801639012166314874104608982"], "threshold":0.9}, "id":"ASB-A-527035781-36c38ec9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/bf8dfb689b691fd9f45eee45bb2acbe18bf51df9", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"20102728011151154153999897544205216947", "length":1276}, "id":"ASB-A-527035781-93dea2fe", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/bf8dfb689b691fd9f45eee45bb2acbe18bf51df9", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"moveTaskToFrontLocked"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bcc3623a3517c6ca2dd394dd787a03f443b48922"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["62011701134777276986251248852539614540", "92172802454453612133839956802899567819", "224387390911462804685994490359867579533", "330199258119220903441018735575446108565", "255406588669344269331232759051632105725", "36416561039801639012166314874104608982"], "threshold":0.9}, "id":"ASB-A-527035781-a3b68181", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/bcc3623a3517c6ca2dd394dd787a03f443b48922", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"20102728011151154153999897544205216947", "length":1276}, "id":"ASB-A-527035781-caabe1b0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/bcc3623a3517c6ca2dd394dd787a03f443b48922", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"moveTaskToFrontLocked"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/830197729015ed2fbac1cd2b632ec955266625f2"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["62011701134777276986251248852539614540", "92172802454453612133839956802899567819", "224387390911462804685994490359867579533", "330199258119220903441018735575446108565", "255406588669344269331232759051632105725", "36416561039801639012166314874104608982"], "threshold":0.9}, "id":"ASB-A-527035781-059e7692", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/830197729015ed2fbac1cd2b632ec955266625f2", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"42346744992559043575359746376775918518", "length":1105}, "id":"ASB-A-527035781-d7662a7b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/830197729015ed2fbac1cd2b632ec955266625f2", "target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java", "function":"moveTaskToFrontLocked"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}