ASB-A-350456241: Input Validation

Q: What access and interaction are required to exploit this issue?

Exploitation requires user interaction. The issue could enable local privilege escalation without requiring additional execution privileges.

Q: What could an attacker gain through successful exploitation?

A successful exploit could reveal images across users, potentially exposing image data belonging to another user on the same device.

Published Nov 1, 2026

Updated

In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected Software

10 affected componentsFixes available

android/platform/frameworks/base>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/packages/modules/intentresolver>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/frameworks/base>=15:0<15:2026-11-01

15:2026-11-01

android/platform/packages/modules/intentresolver>=15:0<15:2026-11-01

15:2026-11-01

android/platform/frameworks/base>=16:0<16:2026-11-01

16:2026-11-01

android/platform/packages/modules/intentresolver>=16:0<16:2026-11-01

16:2026-11-01

android/platform/frameworks/base>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/packages/modules/intentresolver>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/packages/modules/intentresolver>=17:0<17:2026-11-01

17:2026-11-01

android/platform/frameworks/base>=14:0<14:2026-11-01

14:2026-11-01

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 17-qpr2-next:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/IntentResolver to a version that resolves this vulnerability.
Fixed in 17-qpr2-next:2026-11-01
Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 15:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/IntentResolver to a version that resolves this vulnerability.
Fixed in 15:2026-11-01
Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 16:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/IntentResolver to a version that resolves this vulnerability.
Fixed in 16:2026-11-01
Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 16-qpr2:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/IntentResolver to a version that resolves this vulnerability.
Fixed in 16-qpr2:2026-11-01
Upgrade
Upgrade android/platform/packages/modules/IntentResolver to a version that resolves this vulnerability.
Fixed in 17:2026-11-01
Upgrade
Upgrade android/platform/frameworks/base to a version that resolves this vulnerability.
Fixed in 14:2026-11-01

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Exploitation requires user interaction. The issue could enable local privilege escalation without requiring additional execution privileges.

What could an attacker gain through successful exploitation?

A successful exploit could reveal images across users, potentially exposing image data belonging to another user on the same device.