{"id":"ASB-A-277076451","details":"In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-277076451","CVE-2025-22436"],"modified":"2026-11-02T16:56:09.234136153Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"length":3315,"function_hash":"27852702777802956446946993760532873183"},"id":"ASB-A-277076451-14e6aa0f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc","target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp","function":"LayerSnapshotBuilder::updateInput"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["178919437617283077774877895910859052582","111380456252735317263455197200840501304","11244053416831306091967487469587689593","6787638795401806036970479540044787961","157783538096809031353643904907226018034","23709466613914898636501949938533859201","27527102925150114586211728883052581960"]},"id":"ASB-A-277076451-4321dd33","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc","target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"}},{"target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp","function":"RequestedLayerState::needsInputInfo"},"deprecated":false,"digest":{"function_hash":"140989369876152881276210062576714665341","length":404},"id":"ASB-A-277076451-56979a93","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc","target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["138377031501569344570071156268305874328","2287569253564120154783191341104865693","170518268625803685578692170059566066171","298886316803471864874505809069957904140"]},"id":"ASB-A-277076451-9a3d5ff7"},{"target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["187115584872065835124258339878705788931","114492998577407420746356399143929090242","175412779704010986705270160749183400609","26949142478832341270099466787117110"]},"id":"ASB-A-277076451-ae2a6b73","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc"],"severity":"High","spl":"2026-11-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-277076451.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":462,"function_hash":"76645456001427929680655107424504868681"},"id":"ASB-A-277076451-0936ff76","match_only_versions":["15"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e","target":{"file":"libs/gui/SurfaceControl.cpp","function":"SurfaceControl::generateSurfaceLocked"}},{"target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["128135737400769776796077078207687502766","149933555301995305922491793489941606608","194558293354210483895911273661241305885","285302210163662062327481270086288574014"]},"id":"ASB-A-277076451-15a0f45f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8"},{"match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e","target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["105220011585837361037938345749578822927","311945601997285600475698222514156653856","258870565328759151360944177947233954761","169129871573380618306370308952581941680"]},"id":"ASB-A-277076451-40d3af51"},{"id":"ASB-A-277076451-61f7df36","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e","target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp","function":"LayerSnapshotBuilder::updateInput"},"deprecated":false,"digest":{"function_hash":"232550686492620791571962689886998322076","length":3267}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e","target":{"function":"needsInputInfo","file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"},"deprecated":false,"digest":{"length":395,"function_hash":"101602075548295543404928190931550875268"},"id":"ASB-A-277076451-aa8d583f","match_only_versions":["15"],"signature_type":"Function"},{"target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"},"deprecated":false,"digest":{"line_hashes":["108898984718019726123183869764267605390","233123856869104002419687664905789284827","262621183142731668483114808080114521273","9567484725357046489592313641044482765","298886316803471864874505809069957904140"],"threshold":0.9},"id":"ASB-A-277076451-af99509b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e","target":{"file":"libs/gui/SurfaceControl.cpp"},"deprecated":false,"digest":{"line_hashes":["255057014368123870940450721212444174840","53911117399724226795170942851915673910","94164455446402711450330084752025420066","306053644074581509350521785520225180331","80694592891549447935582136065173576100","213952627722867001596811538066895889477"],"threshold":0.9},"id":"ASB-A-277076451-baaea3db","match_only_versions":["15"]},{"target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["155044272526154480922187015190222489734","18002860625520027555481073588300294508","129223925621143283525818562399285453010","328146188331462701753940805816234795411","283035619929566102316203057203148959124","127495867647857042393310844605953761491","185147356067755367457988036883854598072","256675309401884478960626620304567475386","51953411527694178082713572231848516858","257722548820873051954479846885572745439","323892867020990830541419572875073874175","90459806601142480500197760816188983533","317274700460096653257852330161307790572","167707650307608612990449037329628749457","332486249985394067948336217829291010635","284302643563821127506568401640145723057","172452481224296751919078656886698200192","68696661544520616266860396676175702255","297772046054779024203931630979781582606","190656762347268792022937212539546582989","286439796831521652862346644373777956144"]},"id":"ASB-A-277076451-bcd7e77d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e"},{"id":"ASB-A-277076451-bda0bd13","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e","target":{"function":"RequestedLayerState::RequestedLayerState","file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"},"deprecated":false,"digest":{"length":3609,"function_hash":"316561202100474119191796357055408884745"}},{"digest":{"function_hash":"314948560983223847531973593622176950972","length":3266},"id":"ASB-A-277076451-c9204a58","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8","target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp","function":"LayerSnapshotBuilder::updateInput"},"deprecated":false},{"digest":{"line_hashes":["157783538096809031353643904907226018034","23709466613914898636501949938533859201","27527102925150114586211728883052581960"],"threshold":0.9},"id":"ASB-A-277076451-ede5672e","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8","target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8","https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-277076451.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/1cb7e56804a41c98c71ef6c80eb2e44f0b1ac49d","https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e"],"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/1cb7e56804a41c98c71ef6c80eb2e44f0b1ac49d","target":{"file":"services/surfaceflinger/Layer.h"},"deprecated":false,"digest":{"line_hashes":["238525009910210859464347603952218061896","16976057652902572481340380646462930379","305715949065755907407256088028439688330","128202053576384182953996719204114133783"],"threshold":0.9},"id":"ASB-A-277076451-1f47c94a"},{"id":"ASB-A-277076451-37b20ed6","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/1cb7e56804a41c98c71ef6c80eb2e44f0b1ac49d","target":{"file":"services/surfaceflinger/Layer.h","function":"needsInputInfo"},"deprecated":false,"digest":{"function_hash":"27936929993929874048716326856280822663","length":92}},{"deprecated":false,"digest":{"function_hash":"215710529749722061207344159036774039737","length":313},"id":"ASB-A-277076451-37da4312","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e","target":{"function":"Layer::setInputInfo","file":"services/surfaceflinger/Layer.cpp"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e","target":{"file":"services/surfaceflinger/Layer.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["93683255474763354072849610301527133844","68114928085856032543212733903025427514","292651427328025016645012563244481190536","152170461307441087749580560470543607822","21854129723508503117681102296993850823","86661735225991697357452502539957603076","302125276945752472208804497344413458891","274941069939674782230662735421341614294","285974249813489313830360987010569833441","167637840218581818769479152679384229892","249157280252713861571118657571353857671"]},"id":"ASB-A-277076451-6ea29d1d"},{"id":"ASB-A-277076451-8416a118","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e","target":{"file":"services/surfaceflinger/Layer.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["87037403875122739289451646358262770844","323099327199382606268971549381274573943","160231120480841555251235532301425083989","149618833907063867181547771518633021012","24291380174787456921442931217888800450","205002071888333412311357636307298151624","40040684718506752338375500701912096594","16861210677265303421161563316125873201"]}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-277076451.json"}}],"schema_version":"1.9.2"}