{"id":"ASB-A-266433089","details":"In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-266433089","CVE-2025-48621"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/cc34c7b416b964c05a42ae3e9c2929b59b92c64f"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/6d1697c96c5cae5062f6aea58cf2665b7d646cb8"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["102376982044160493164054560424829740992","66499418353376395208915744637021515921","130252057911911557120901590373891803764","290301398973385244038766360757378904818"]},"id":"ASB-A-266433089-3a792091","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/34f7093f864616059caad72366409ab1b4792675","target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/transition/DefaultTransitionHandler.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/34f7093f864616059caad72366409ab1b4792675"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["5394850696851107489683868258220425241","118260498044634936657883368239434792272","111512741543011694653014009302648536530"],"threshold":0.9},"id":"ASB-A-266433089-00e74b31","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/626f4201c51f294dbf1dd37034aa8bd2cd549826","target":{"file":"services/inputflinger/dispatcher/InputDispatcher.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/626f4201c51f294dbf1dd37034aa8bd2cd549826"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/1d37fc960d93d216e151d74662ccc5d53fd68978","target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/transition/DefaultTransitionHandler.java"},"deprecated":false,"digest":{"line_hashes":["248856889590144885621918607836282539025","144531626938778448552179873240849072977","106039877743107897291918924499970282509","188457292567742801376067883879181012870"],"threshold":0.9},"id":"ASB-A-266433089-7562e2de","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1d37fc960d93d216e151d74662ccc5d53fd68978"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/a1c211a49aff429e54e9d0f41649ab18c1b4e22d"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/a1c211a49aff429e54e9d0f41649ab18c1b4e22d","target":{"file":"services/inputflinger/dispatcher/InputDispatcher.cpp"},"deprecated":false,"digest":{"line_hashes":["154201780020139837239759456663197568923","307574667483685234664799342826226447129","111512741543011694653014009302648536530"],"threshold":0.9},"id":"ASB-A-266433089-863a7e80","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/a1c211a49aff429e54e9d0f41649ab18c1b4e22d","target":{"file":"services/inputflinger/dispatcher/InputDispatcher.cpp","function":"InputDispatcher::canWindowReceiveMotionLocked"},"deprecated":false,"digest":{"function_hash":"293883125124188735835403008805557989755","length":1841},"id":"ASB-A-266433089-fa767d19"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/71d67882398e9a28c268e19d5a5d66ff7632c4ed","target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/transition/DefaultTransitionHandler.java"},"deprecated":false,"digest":{"line_hashes":["248856889590144885621918607836282539025","170601685298913636518152436052267910966","130252057911911557120901590373891803764","290301398973385244038766360757378904818"],"threshold":0.9},"id":"ASB-A-266433089-6f7088c2","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/71d67882398e9a28c268e19d5a5d66ff7632c4ed"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-266433089-5dc813ca","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/61b3b73116cb7fc760683db1d02e6466522aacbf","target":{"file":"services/inputflinger/dispatcher/InputDispatcher.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["5394850696851107489683868258220425241","118260498044634936657883368239434792272","111512741543011694653014009302648536530"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/61b3b73116cb7fc760683db1d02e6466522aacbf"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["248856889590144885621918607836282539025","44536510841965663279992936573567125690","5614311063228002728842156457546024868","286505572372986416403478625591453334143"],"threshold":0.9},"id":"ASB-A-266433089-bf2b2d08","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1e9412266ede59c046b83ad3a3fbfcaba94a1787","target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/transition/DefaultTransitionHandler.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1e9412266ede59c046b83ad3a3fbfcaba94a1787"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/inputflinger/dispatcher/InputDispatcher.cpp","function":"InputDispatcher::findTouchedWindowTargetsLocked"},"deprecated":false,"digest":{"function_hash":"55669835188213314027306847272836052850","length":11604},"id":"ASB-A-266433089-44b6301a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/9f65d0158f853ca4571a7af155969f0081d79a49"},{"digest":{"threshold":0.9,"line_hashes":["108905384051329200733903586878036295580","177927706532921712772368279218975722500","216405314139094600963822921191872050443","219664331880740055396330504946416842747"]},"id":"ASB-A-266433089-c6b4d22f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/9f65d0158f853ca4571a7af155969f0081d79a49","target":{"file":"services/inputflinger/dispatcher/InputDispatcher.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/9f65d0158f853ca4571a7af155969f0081d79a49"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["248856889590144885621918607836282539025","144531626938778448552179873240849072977","106039877743107897291918924499970282509","188457292567742801376067883879181012870"],"threshold":0.9},"id":"ASB-A-266433089-eaff47c8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f849cfc111ebb8324bdf11039b4a5dc998feefa","target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/transition/DefaultTransitionHandler.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0f849cfc111ebb8324bdf11039b4a5dc998feefa"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/3c01b64e016060ce736a893922aec1f2ebca2995","target":{"file":"services/inputflinger/dispatcher/InputDispatcher.cpp","function":"InputDispatcher::canWindowReceiveMotionLocked"},"deprecated":false,"digest":{"length":1546,"function_hash":"75330836211644953868411228713032159909"},"id":"ASB-A-266433089-39d8b960","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["154201780020139837239759456663197568923","307574667483685234664799342826226447129","111512741543011694653014009302648536530"],"threshold":0.9},"id":"ASB-A-266433089-e28b9735","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/3c01b64e016060ce736a893922aec1f2ebca2995","target":{"file":"services/inputflinger/dispatcher/InputDispatcher.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/3c01b64e016060ce736a893922aec1f2ebca2995"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-266433089.json"}}],"schema_version":"1.9.0"}