{"id":"ASB-A-332277530","details":"In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-332277530","CVE-2025-22417"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/89e32320207c1f332dd84024a13b001320d8c63d"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7366b99644fa61279591eec54ea725d86d6e2e93","target":{"file":"services/core/java/com/android/server/wm/Transition.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["43321757872081070203107079530285764904","259474736871594508473064173875742022169","101281647174481639614123120420791051658","155627851148060635493144740141300058646","312852115778852061550559717320465254123","205318740049287123336964596818420624210","320472561389268828203707612226200794736","216764919076282728530001542877030237993","50282303557542167369505078076179223325","266662712364569598772809999191737064845","128514549824767817510309341388653812373","192690854717832912272169549773659020179","303989072137136356410617273412967353341"]},"id":"ASB-A-332277530-b918e16c"},{"id":"ASB-A-332277530-c66090ac","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7366b99644fa61279591eec54ea725d86d6e2e93","target":{"file":"services/core/java/com/android/server/wm/Transition.java","function":"finishTransition"},"deprecated":false,"digest":{"function_hash":"143495626557028892849843957874352481508","length":8338}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7366b99644fa61279591eec54ea725d86d6e2e93"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-332277530.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-04-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/24aeaa1b55d3c602ddd4e53a44bf304a21c8d3df","target":{"file":"services/core/java/com/android/server/wm/Transition.java","function":"finishTransition"},"deprecated":false,"digest":{"length":7609,"function_hash":"271949306122158318157587281129860000967"},"id":"ASB-A-332277530-f52c4474","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/24aeaa1b55d3c602ddd4e53a44bf304a21c8d3df","target":{"file":"services/core/java/com/android/server/wm/Transition.java"},"deprecated":false,"digest":{"line_hashes":["43321757872081070203107079530285764904","259474736871594508473064173875742022169","101281647174481639614123120420791051658","155627851148060635493144740141300058646","312852115778852061550559717320465254123","205318740049287123336964596818420624210","320472561389268828203707612226200794736","216764919076282728530001542877030237993","50282303557542167369505078076179223325","266662712364569598772809999191737064845","128514549824767817510309341388653812373","192690854717832912272169549773659020179","303989072137136356410617273412967353341"],"threshold":0.9},"id":"ASB-A-332277530-fa0356f9","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/24aeaa1b55d3c602ddd4e53a44bf304a21c8d3df"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-332277530.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-04-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/806927c67cbb308739b06efe78ee474c83b66e24","target":{"file":"services/core/java/com/android/server/wm/Transition.java"},"deprecated":false,"digest":{"line_hashes":["2482795662706534945073011631338541735","259474736871594508473064173875742022169","101281647174481639614123120420791051658","155627851148060635493144740141300058646","312852115778852061550559717320465254123","205318740049287123336964596818420624210","320472561389268828203707612226200794736","216764919076282728530001542877030237993","50282303557542167369505078076179223325","266662712364569598772809999191737064845","128514549824767817510309341388653812373","192690854717832912272169549773659020179","303989072137136356410617273412967353341"],"threshold":0.9},"id":"ASB-A-332277530-1c277f23","signature_type":"Line"},{"digest":{"function_hash":"37129745043719104312132640350457045810","length":7105},"id":"ASB-A-332277530-3ef6f4ed","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/806927c67cbb308739b06efe78ee474c83b66e24","target":{"file":"services/core/java/com/android/server/wm/Transition.java","function":"finishTransition"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/806927c67cbb308739b06efe78ee474c83b66e24"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-332277530.json"}}],"schema_version":"1.9.0"}