{"id":"ASB-A-152064592","details":"In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-152064592","CVE-2021-0438"],"modified":"2026-07-10T15:26:01.587957612Z","published":"2021-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2021-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/d49dbebe1acc5788a300cf6772f25c8ab88a1df3"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2021-04-01"}]}],"versions":["8.1"],"ecosystem_specific":{"types":["EoP"],"severity":"High","spl":"2021-04-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63"],"vanir_signatures":[{"signature_version":"v1","target":{"function":"addWindow","file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"digest":{"function_hash":"245417364887964578931082778496842187324","length":11538},"source":"https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63","id":"ASB-A-152064592-01b10344","signature_type":"Function","deprecated":false},{"signature_version":"v1","signature_type":"Function","digest":{"function_hash":"120548723177840845919256656497900625926","length":6838},"source":"https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63","id":"ASB-A-152064592-2cc1f695","target":{"function":"setView","file":"core/java/android/view/ViewRootImpl.java"},"deprecated":false},{"signature_version":"v1","signature_type":"Line","digest":{"line_hashes":["191756847136270296369553763081771832688","106390184753104213513027313323794346740","114298727263903920143565307254917568216","85431566168118264752420830628812281522","162443295245741336675999627289494297403"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63","id":"ASB-A-152064592-3070776d","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["144314963066041979339326556589679816627","26796930622200074222979280170233243811","63210466038713291057509881786749335701"],"threshold":0.9},"signature_type":"Line","source":"https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63","id":"ASB-A-152064592-4e9c5c27","target":{"file":"core/java/android/view/InputChannel.java"},"deprecated":false},{"signature_version":"v1","signature_type":"Line","digest":{"line_hashes":["232764122002406498189910346406296609933","267461055333102777668738625415609828294","111687512615550132499321364881693223187","107793811789574803013945368211033877433","223813062959423223440481869870848888888","105268195857313583150489635476326296352","205111092423982176402492038393576354845","207096956224682607809407367494887235819","74757220120589641769880561030983441264","324669705019895517519890249251155226442","311504105775882186708492469294199040366"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/9661bf7a40d33470bcd35f15758ab71c7c635c63","id":"ASB-A-152064592-9b134427","target":{"file":"core/java/android/view/ViewRootImpl.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-152064592.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2021-04-01"}]}],"versions":["9"],"ecosystem_specific":{"types":["EoP"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1"],"spl":"2021-04-01","vanir_signatures":[{"signature_version":"v1","signature_type":"Function","digest":{"function_hash":"154181737550920605205700378612111025202","length":7105},"source":"https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1","id":"ASB-A-152064592-2b3012c7","target":{"function":"setView","file":"core/java/android/view/ViewRootImpl.java"},"deprecated":false},{"signature_version":"v1","target":{"file":"core/java/android/view/ViewRootImpl.java"},"signature_type":"Line","source":"https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1","id":"ASB-A-152064592-59927bf6","digest":{"line_hashes":["232764122002406498189910346406296609933","267461055333102777668738625415609828294","111687512615550132499321364881693223187","107793811789574803013945368211033877433","223813062959423223440481869870848888888","105268195857313583150489635476326296352","205111092423982176402492038393576354845","207096956224682607809407367494887235819","74757220120589641769880561030983441264","324669705019895517519890249251155226442","311504105775882186708492469294199040366"],"threshold":0.9},"deprecated":false},{"signature_version":"v1","target":{"file":"core/java/android/view/InputChannel.java"},"signature_type":"Line","source":"https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1","id":"ASB-A-152064592-84da5882","digest":{"line_hashes":["144314963066041979339326556589679816627","26796930622200074222979280170233243811","63210466038713291057509881786749335701"],"threshold":0.9},"deprecated":false},{"signature_version":"v1","signature_type":"Line","digest":{"line_hashes":["191756847136270296369553763081771832688","106390184753104213513027313323794346740","114298727263903920143565307254917568216","85431566168118264752420830628812281522","162443295245741336675999627289494297403"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1","id":"ASB-A-152064592-ca660a01","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false},{"signature_version":"v1","target":{"function":"addWindow","file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"signature_type":"Function","source":"https://android.googlesource.com/platform/frameworks/base/+/0fed2d8e7e2b9757c7c40cd445772d52398478b1","id":"ASB-A-152064592-f1d7ea8d","digest":{"function_hash":"150734779361418601709594417967709985204","length":11895},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-152064592.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2021-04-01"}]}],"versions":["10"],"ecosystem_specific":{"types":["EoP"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9"],"spl":"2021-04-01","vanir_signatures":[{"signature_version":"v1","signature_type":"Line","digest":{"line_hashes":["191756847136270296369553763081771832688","106390184753104213513027313323794346740","114298727263903920143565307254917568216","85431566168118264752420830628812281522","162443295245741336675999627289494297403"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9","id":"ASB-A-152064592-02ba8553","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false},{"signature_version":"v1","signature_type":"Line","digest":{"line_hashes":["232764122002406498189910346406296609933","267461055333102777668738625415609828294","111687512615550132499321364881693223187","107793811789574803013945368211033877433","223813062959423223440481869870848888888","105268195857313583150489635476326296352","205111092423982176402492038393576354845","207096956224682607809407367494887235819","74757220120589641769880561030983441264","324669705019895517519890249251155226442","311504105775882186708492469294199040366"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9","id":"ASB-A-152064592-0ef61e24","target":{"file":"core/java/android/view/ViewRootImpl.java"},"deprecated":false},{"signature_version":"v1","signature_type":"Function","digest":{"function_hash":"83733493411385955548328862155120065153","length":7207},"source":"https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9","id":"ASB-A-152064592-238dff57","target":{"function":"setView","file":"core/java/android/view/ViewRootImpl.java"},"deprecated":false},{"signature_version":"v1","target":{"file":"core/java/android/view/InputChannel.java"},"digest":{"line_hashes":["144314963066041979339326556589679816627","26796930622200074222979280170233243811","63210466038713291057509881786749335701"],"threshold":0.9},"source":"https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9","id":"ASB-A-152064592-97449418","signature_type":"Line","deprecated":false},{"signature_version":"v1","signature_type":"Function","digest":{"function_hash":"94006466396770710472872429492784209001","length":11965},"source":"https://android.googlesource.com/platform/frameworks/base/+/514b3297768f4a7469117a7005556663124040f9","id":"ASB-A-152064592-98f727e2","target":{"function":"addWindow","file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-152064592.json"}}],"schema_version":"1.7.5"}