{"id":"ASB-A-527036176", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58974", "A-527036176"], "details":"In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"254756202945044017983340208008594186703", "length":1409}, "id":"ASB-A-527036176-27c89c04", "match_only_versions":["17-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f", "target":{"file":"core/java/android/os/Binder.java", "function":"onShellCommand"}}, {"deprecated":false, "digest":{"line_hashes":["200150622722840859512874629774355797161", "334312262691176547190964272951743523005", "326635729397598627440176343103780594072", "7789538731787653007042207216705328657"], "threshold":0.9}, "id":"ASB-A-527036176-464a19db", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"}}, {"deprecated":false, "digest":{"line_hashes":["224412128432702335873494000300338225386", "317252062471637607374019347752961870835", "181573889494107209853229754953908744053", "302033350515499424860335407153973995592", "215187824298931299292553244399989910044", "188242131689888584309477795810181248455", "155519689672058273751795971522394075396", "153165129434553141139131647291026347801", "242128928378382133731892180874546068540", "181321619002047399963138584572953430843", "110530567039366567086632157752472759501"], "threshold":0.9}, "id":"ASB-A-527036176-5c479331", "match_only_versions":["17-qpr2-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f", "target":{"file":"core/java/android/os/Binder.java"}}, {"deprecated":false, "digest":{"function_hash":"266863510474315262488227988797878654698", "length":196}, "id":"ASB-A-527036176-61ae4709", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/41251a751e8ae1b368f035d4a02d8b200071a38f", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java", "function":"onShellCommand"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"266863510474315262488227988797878654698", "length":196}, "id":"ASB-A-527036176-26e4c269", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java", "function":"onShellCommand"}}, {"deprecated":false, "digest":{"function_hash":"254756202945044017983340208008594186703", "length":1409}, "id":"ASB-A-527036176-6713c2cc", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60", "target":{"file":"core/java/android/os/Binder.java", "function":"onShellCommand"}}, {"deprecated":false, "digest":{"line_hashes":["200150622722840859512874629774355797161", "334312262691176547190964272951743523005", "326635729397598627440176343103780594072", "32126585500871840016330705785166556816"], "threshold":0.9}, "id":"ASB-A-527036176-c2dc9ca1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"}}, {"deprecated":false, "digest":{"line_hashes":["78679364347369504733144188217313619822", "196170694888987423643355606095205774638", "181478182630068703693810259999230260630", "302033350515499424860335407153973995592", "215187824298931299292553244399989910044", "188242131689888584309477795810181248455", "155519689672058273751795971522394075396", "153165129434553141139131647291026347801", "242128928378382133731892180874546068540", "181321619002047399963138584572953430843", "110530567039366567086632157752472759501"], "threshold":0.9}, "id":"ASB-A-527036176-cc59bd00", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/37cac1e109af31911507c4a07125ea4533802d60", "target":{"file":"core/java/android/os/Binder.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["200150622722840859512874629774355797161", "334312262691176547190964272951743523005", "326635729397598627440176343103780594072", "7789538731787653007042207216705328657"], "threshold":0.9}, "id":"ASB-A-527036176-2226c5fc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"254756202945044017983340208008594186703", "length":1409}, "id":"ASB-A-527036176-c27447b8", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d", "target":{"file":"core/java/android/os/Binder.java", "function":"onShellCommand"}}, {"deprecated":false, "digest":{"line_hashes":["78679364347369504733144188217313619822", "196170694888987423643355606095205774638", "181478182630068703693810259999230260630", "302033350515499424860335407153973995592", "215187824298931299292553244399989910044", "188242131689888584309477795810181248455", "155519689672058273751795971522394075396", "153165129434553141139131647291026347801", "242128928378382133731892180874546068540", "181321619002047399963138584572953430843", "110530567039366567086632157752472759501"], "threshold":0.9}, "id":"ASB-A-527036176-ca0c8f6a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d", "target":{"file":"core/java/android/os/Binder.java"}}, {"deprecated":false, "digest":{"function_hash":"266863510474315262488227988797878654698", "length":196}, "id":"ASB-A-527036176-f5c6d681", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/27540b25e5b69592f5c1a93560205daa30f1bf3d", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java", "function":"onShellCommand"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"266863510474315262488227988797878654698", "length":196}, "id":"ASB-A-527036176-0bbaeec5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java", "function":"onShellCommand"}}, {"deprecated":false, "digest":{"line_hashes":["78679364347369504733144188217313619822", "196170694888987423643355606095205774638", "181478182630068703693810259999230260630", "302033350515499424860335407153973995592", "215187824298931299292553244399989910044", "188242131689888584309477795810181248455", "155519689672058273751795971522394075396", "153165129434553141139131647291026347801", "242128928378382133731892180874546068540", "181321619002047399963138584572953430843", "110530567039366567086632157752472759501"], "threshold":0.9}, "id":"ASB-A-527036176-1f49cd47", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8", "target":{"file":"core/java/android/os/Binder.java"}}, {"deprecated":false, "digest":{"line_hashes":["200150622722840859512874629774355797161", "334312262691176547190964272951743523005", "326635729397598627440176343103780594072", "7789538731787653007042207216705328657"], "threshold":0.9}, "id":"ASB-A-527036176-7c48c74c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"254756202945044017983340208008594186703", "length":1409}, "id":"ASB-A-527036176-bf3bb7c1", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/28f7be9e71aaa7cea80a83e0a42b62a8271640b8", "target":{"file":"core/java/android/os/Binder.java", "function":"onShellCommand"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["78679364347369504733144188217313619822", "196170694888987423643355606095205774638", "181478182630068703693810259999230260630", "302033350515499424860335407153973995592", "215187824298931299292553244399989910044", "188242131689888584309477795810181248455", "155519689672058273751795971522394075396", "153165129434553141139131647291026347801", "242128928378382133731892180874546068540", "181321619002047399963138584572953430843", "110530567039366567086632157752472759501"], "threshold":0.9}, "id":"ASB-A-527036176-0f9f100a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1", "target":{"file":"core/java/android/os/Binder.java"}}, {"deprecated":false, "digest":{"line_hashes":["200150622722840859512874629774355797161", "334312262691176547190964272951743523005", "326635729397598627440176343103780594072", "7789538731787653007042207216705328657"], "threshold":0.9}, "id":"ASB-A-527036176-263df9a6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"254756202945044017983340208008594186703", "length":1409}, "id":"ASB-A-527036176-a05eca5c", "match_only_versions":["17"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1", "target":{"file":"core/java/android/os/Binder.java", "function":"onShellCommand"}}, {"deprecated":false, "digest":{"function_hash":"266863510474315262488227988797878654698", "length":196}, "id":"ASB-A-527036176-d30c7f47", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f5a1c95d0084b37c04bf1d53db8fa881403b94a1", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java", "function":"onShellCommand"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"266863510474315262488227988797878654698", "length":196}, "id":"ASB-A-527036176-47a3bf94", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java", "function":"onShellCommand"}}, {"deprecated":false, "digest":{"line_hashes":["78679364347369504733144188217313619822", "196170694888987423643355606095205774638", "181478182630068703693810259999230260630", "302033350515499424860335407153973995592", "215187824298931299292553244399989910044", "188242131689888584309477795810181248455", "155519689672058273751795971522394075396", "153165129434553141139131647291026347801", "242128928378382133731892180874546068540", "181321619002047399963138584572953430843", "110530567039366567086632157752472759501"], "threshold":0.9}, "id":"ASB-A-527036176-77635436", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417", "target":{"file":"core/java/android/os/Binder.java"}}, {"deprecated":false, "digest":{"function_hash":"254756202945044017983340208008594186703", "length":1409}, "id":"ASB-A-527036176-8ef6ee3a", "match_only_versions":["14"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417", "target":{"file":"core/java/android/os/Binder.java", "function":"onShellCommand"}}, {"deprecated":false, "digest":{"line_hashes":["200150622722840859512874629774355797161", "334312262691176547190964272951743523005", "326635729397598627440176343103780594072", "32126585500871840016330705785166556816"], "threshold":0.9}, "id":"ASB-A-527036176-c9d526a4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c83dd8307f835e5f47d7f8175109b52d61f86417", "target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}