{"id":"ASB-A-366405211","details":"In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-366405211","CVE-2026-0005"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/92b109b6041452f6e713dcce512fa8de18556360"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"digest":{"line_hashes":["312613614161868944866091854443080408141","122437842048045772090835283628580660228","314646606167297330119270266462598785381"],"threshold":0.9},"id":"ASB-A-366405211-213504bc","match_only_versions":["16-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/575845147cb48d71893f12665bae2e8892aa7e06","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["257558208854102221961475193619356994313","266982570076036454971945458857341223012","110744525169120606714442510787246584052","39049326366674602475728549990412471899","104052523671044076921826450147227892836"]},"id":"ASB-A-366405211-273816f8","match_only_versions":["16-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/575845147cb48d71893f12665bae2e8892aa7e06","target":{"file":"services/core/java/com/android/server/policy/keyguard/KeyguardServiceDelegate.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/575845147cb48d71893f12665bae2e8892aa7e06","target":{"function":"onBootCompleted","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"function_hash":"155114677624689918567865373055519737249","length":304},"id":"ASB-A-366405211-30113806","match_only_versions":["16-qpr2-next"],"signature_type":"Function"},{"id":"ASB-A-366405211-8a65fcad","match_only_versions":["16-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/575845147cb48d71893f12665bae2e8892aa7e06","target":{"file":"services/core/java/com/android/server/policy/keyguard/KeyguardServiceDelegate.java","function":"onServiceDisconnected"},"deprecated":false,"digest":{"length":309,"function_hash":"165224352031574091486954619054521859011"}},{"target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"line_hashes":["188740867167127335915569500118973790322","84330890575215797028099298130137947054","293188552758682695276487170529963563504","31486765646964059850758010433622056728","329174108340331449967704107737379573499","314471725614292304082539536551500932481","267173757964726372141966533857611426209","78302100577507850275493820812633577143","311941396213254451863721356851040172550"],"threshold":0.9},"id":"ASB-A-366405211-99cc0c73","match_only_versions":["16-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/575845147cb48d71893f12665bae2e8892aa7e06"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/575845147cb48d71893f12665bae2e8892aa7e06","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["59919574519062909568518435099235531208","20050232685143592671371007866148642619","71345633509069511639142624113838715266"]},"id":"ASB-A-366405211-dc248f78","match_only_versions":["16-qpr2-next"],"signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/575845147cb48d71893f12665bae2e8892aa7e06"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366405211.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8a0f8df37587f1677cc6ab80a567d8f82ff78121"],"severity":"High","spl":"2026-03-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a0f8df37587f1677cc6ab80a567d8f82ff78121","target":{"file":"services/core/java/com/android/server/policy/keyguard/KeyguardServiceDelegate.java","function":"onServiceDisconnected"},"deprecated":false,"digest":{"function_hash":"165224352031574091486954619054521859011","length":309},"id":"ASB-A-366405211-12539f36","match_only_versions":["15"],"signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/8a0f8df37587f1677cc6ab80a567d8f82ff78121","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"line_hashes":["188740867167127335915569500118973790322","84330890575215797028099298130137947054","293188552758682695276487170529963563504","31486765646964059850758010433622056728","329174108340331449967704107737379573499","314471725614292304082539536551500932481","267173757964726372141966533857611426209","78302100577507850275493820812633577143","311941396213254451863721356851040172550"],"threshold":0.9},"id":"ASB-A-366405211-73ba153a","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a0f8df37587f1677cc6ab80a567d8f82ff78121","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"line_hashes":["59919574519062909568518435099235531208","20050232685143592671371007866148642619","71345633509069511639142624113838715266"],"threshold":0.9},"id":"ASB-A-366405211-a0b4852b","match_only_versions":["15"]},{"match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a0f8df37587f1677cc6ab80a567d8f82ff78121","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["312613614161868944866091854443080408141","122437842048045772090835283628580660228","314646606167297330119270266462598785381"]},"id":"ASB-A-366405211-b2d1adb4"},{"deprecated":false,"digest":{"line_hashes":["257558208854102221961475193619356994313","266982570076036454971945458857341223012","110744525169120606714442510787246584052","39049326366674602475728549990412471899","104052523671044076921826450147227892836"],"threshold":0.9},"id":"ASB-A-366405211-b6a20638","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a0f8df37587f1677cc6ab80a567d8f82ff78121","target":{"file":"services/core/java/com/android/server/policy/keyguard/KeyguardServiceDelegate.java"}},{"target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"onBootCompleted"},"deprecated":false,"digest":{"function_hash":"155114677624689918567865373055519737249","length":304},"id":"ASB-A-366405211-dbea9b6f","match_only_versions":["15"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a0f8df37587f1677cc6ab80a567d8f82ff78121"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366405211.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/06e5f6cb4e893155d46b5e329a00495fccdc71eb"],"severity":"High","spl":"2026-03-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["312613614161868944866091854443080408141","122437842048045772090835283628580660228","314646606167297330119270266462598785381"],"threshold":0.9},"id":"ASB-A-366405211-1137a820","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/06e5f6cb4e893155d46b5e329a00495fccdc71eb","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"}},{"target":{"file":"services/core/java/com/android/server/policy/keyguard/KeyguardServiceDelegate.java","function":"onServiceDisconnected"},"deprecated":false,"digest":{"length":309,"function_hash":"165224352031574091486954619054521859011"},"id":"ASB-A-366405211-6abe5a53","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/06e5f6cb4e893155d46b5e329a00495fccdc71eb"},{"id":"ASB-A-366405211-c13a983b","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/06e5f6cb4e893155d46b5e329a00495fccdc71eb","target":{"file":"services/core/java/com/android/server/policy/keyguard/KeyguardServiceDelegate.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["257558208854102221961475193619356994313","266982570076036454971945458857341223012","110744525169120606714442510787246584052","39049326366674602475728549990412471899","104052523671044076921826450147227892836"]}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/06e5f6cb4e893155d46b5e329a00495fccdc71eb","target":{"function":"onBootCompleted","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"function_hash":"155114677624689918567865373055519737249","length":304},"id":"ASB-A-366405211-c7005ba5","match_only_versions":["16"],"signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/06e5f6cb4e893155d46b5e329a00495fccdc71eb","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"line_hashes":["188740867167127335915569500118973790322","84330890575215797028099298130137947054","293188552758682695276487170529963563504","31486765646964059850758010433622056728","329174108340331449967704107737379573499","314471725614292304082539536551500932481","267173757964726372141966533857611426209","78302100577507850275493820812633577143","311941396213254451863721356851040172550"],"threshold":0.9},"id":"ASB-A-366405211-ee8a02a6","match_only_versions":["16"]},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/06e5f6cb4e893155d46b5e329a00495fccdc71eb","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["59919574519062909568518435099235531208","20050232685143592671371007866148642619","71345633509069511639142624113838715266"]},"id":"ASB-A-366405211-f39e7e17","match_only_versions":["16"],"signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366405211.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-03-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/35fb7e8e90148c1c4fda7f171eda79955d9b37a7","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"line_hashes":["312613614161868944866091854443080408141","122437842048045772090835283628580660228","314646606167297330119270266462598785381"],"threshold":0.9},"id":"ASB-A-366405211-0f6a992a","match_only_versions":["14"],"signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["257558208854102221961475193619356994313","266982570076036454971945458857341223012","110744525169120606714442510787246584052","39049326366674602475728549990412471899","104052523671044076921826450147227892836"],"threshold":0.9},"id":"ASB-A-366405211-12ae8f7e","match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/35fb7e8e90148c1c4fda7f171eda79955d9b37a7","target":{"file":"services/core/java/com/android/server/policy/keyguard/KeyguardServiceDelegate.java"}},{"match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/35fb7e8e90148c1c4fda7f171eda79955d9b37a7","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"onBootCompleted"},"deprecated":false,"digest":{"function_hash":"155114677624689918567865373055519737249","length":304},"id":"ASB-A-366405211-273c3e59"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/35fb7e8e90148c1c4fda7f171eda79955d9b37a7","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"line_hashes":["59919574519062909568518435099235531208","20050232685143592671371007866148642619","71345633509069511639142624113838715266"],"threshold":0.9},"id":"ASB-A-366405211-67aa8c11","match_only_versions":["14"],"signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-366405211-7e7be757","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/35fb7e8e90148c1c4fda7f171eda79955d9b37a7","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["164090408475328666551302398136644410778","314471725614292304082539536551500932481","267173757964726372141966533857611426209","78302100577507850275493820812633577143","311941396213254451863721356851040172550"]}},{"digest":{"length":309,"function_hash":"165224352031574091486954619054521859011"},"id":"ASB-A-366405211-d78e369f","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/35fb7e8e90148c1c4fda7f171eda79955d9b37a7","target":{"file":"services/core/java/com/android/server/policy/keyguard/KeyguardServiceDelegate.java","function":"onServiceDisconnected"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/35fb7e8e90148c1c4fda7f171eda79955d9b37a7"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366405211.json"}}],"schema_version":"1.9.0"}