ASB-A-442392902 — Vulnetix

ASB-A-442392902 PUBLISHED

In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Products

Vendor	Product	Versions
platform	frameworks/base	16-qpr2-next:0, 16-qpr2-next, 16-qpr2:0

Timeline

Mar 1, 2026 CVE Published
May 15, 2026 CVE Updated

References

https://source.android.com/security/bulletin/2026-03-01 advisory
https://android.googlesource.com/platform/frameworks/base/+/924df83d73d9f938fde025c2e793ca12646207e0 patch

Open in Interactive Console →