{"affected":[{"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527034642.json"},"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["66626885679975416344591914439836620015","298236227127430811248567657295975947972","120841021482464668877120412446517404938"],"threshold":0.9},"id":"ASB-A-527034642-0721f6b5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366","target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"}},{"deprecated":false,"digest":{"function_hash":"277225765274953645649780085194809424659","length":563},"id":"ASB-A-527034642-3a6995d0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/384a408196c33bedcd324b165bb5aaf259515366","target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java","function":"navigateUpTo"}}]},"package":{"ecosystem":"Android","name":"platform/frameworks/base"},"ranges":[{"events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}],"type":"ECOSYSTEM"}],"versions":["17-qpr2-next"]},{"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527034642.json"},"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/251949ef9f045abc67c169dd0cceb076ad9d9c7e"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["308109601750817782096252523506789553926","332618966041723367115481096434693326044","252549206848878189123090693328808540697"],"threshold":0.9},"id":"ASB-A-527034642-bd6b877f","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/251949ef9f045abc67c169dd0cceb076ad9d9c7e","target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"}},{"deprecated":false,"digest":{"function_hash":"243161130442187690972303800278616305359","length":461},"id":"ASB-A-527034642-e7e2da49","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/251949ef9f045abc67c169dd0cceb076ad9d9c7e","target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java","function":"navigateUpTo"}}]},"package":{"ecosystem":"Android","name":"platform/frameworks/base"},"ranges":[{"events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}],"type":"ECOSYSTEM"}],"versions":["16"]},{"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527034642.json"},"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/072555e9730d029a38a72128be46831889dc426e"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"243161130442187690972303800278616305359","length":461},"id":"ASB-A-527034642-7f36e996","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/072555e9730d029a38a72128be46831889dc426e","target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java","function":"navigateUpTo"}},{"deprecated":false,"digest":{"line_hashes":["308109601750817782096252523506789553926","332618966041723367115481096434693326044","252549206848878189123090693328808540697"],"threshold":0.9},"id":"ASB-A-527034642-c3c6f547","match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/072555e9730d029a38a72128be46831889dc426e","target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"}}]},"package":{"ecosystem":"Android","name":"platform/frameworks/base"},"ranges":[{"events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}],"type":"ECOSYSTEM"}],"versions":["16-qpr2"]},{"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527034642.json"},"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9315367cd50d1e5434efd4a818193322f915f210"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["308109601750817782096252523506789553926","332618966041723367115481096434693326044","252549206848878189123090693328808540697"],"threshold":0.9},"id":"ASB-A-527034642-6348d546","match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9315367cd50d1e5434efd4a818193322f915f210","target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java"}},{"deprecated":false,"digest":{"function_hash":"243161130442187690972303800278616305359","length":461},"id":"ASB-A-527034642-93aa435a","match_only_versions":["17"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9315367cd50d1e5434efd4a818193322f915f210","target":{"file":"services/core/java/com/android/server/wm/ActivityClientController.java","function":"navigateUpTo"}}]},"package":{"ecosystem":"Android","name":"platform/frameworks/base"},"ranges":[{"events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}],"type":"ECOSYSTEM"}],"versions":["17"]}],"aliases":["A-527034642","CVE-2026-58946"],"details":"In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","id":"ASB-A-527034642","modified":"2026-11-04T17:16:44.225619976Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"schema_version":"1.9.2"}