{"id":"ASB-A-376048041","details":"In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-376048041","CVE-2025-48570"],"modified":"2026-06-12T15:08:17.296522730Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/c0f88bec3bf04db6a1ba3fad276dcde898de0f5e"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/94929458bc265ddf2962b35d5cda67751ee46fb6"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["269441865083221342326649577408145318077","156028149703521146675302373922355731176","225142177803471708763815187234494831067","86456216060200998801052865306828085812","284311963398253730348276618691952946244","276680722652991468837962084545001934614","236294929586587556930146569612945389373","87118459847215512901729674145684266933","24012896710107546920510062811017547571","284117436700839151443346954822213275980","142390309047380255238570596373879287290","28214925196935934081409457351289558849","107595101497419692725034617107836312544","113664377780682502555612390814443940370","154601613639577492178775769089451278614","37010348331977835696228704116407514139","333319740463213949623442906026781860136"]},"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java"},"signature_type":"Line","id":"ASB-A-376048041-1e5ec15e","deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1","signature_version":"v1","digest":{"length":1534,"function_hash":"146247374016712456008217424681411651440"},"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java","function":"PipTaskOrganizer"},"signature_type":"Function","id":"ASB-A-376048041-3879e528","deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34","signature_version":"v1","digest":{"length":1534,"function_hash":"146247374016712456008217424681411651440"},"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java","function":"PipTaskOrganizer"},"signature_type":"Function","id":"ASB-A-376048041-97389212","deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["269441865083221342326649577408145318077","156028149703521146675302373922355731176","225142177803471708763815187234494831067","86456216060200998801052865306828085812","284311963398253730348276618691952946244","276680722652991468837962084545001934614","236294929586587556930146569612945389373","87118459847215512901729674145684266933","24012896710107546920510062811017547571","284117436700839151443346954822213275980","142390309047380255238570596373879287290","28214925196935934081409457351289558849","107595101497419692725034617107836312544","113664377780682502555612390814443940370","154601613639577492178775769089451278614","37010348331977835696228704116407514139","333319740463213949623442906026781860136"]},"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java"},"signature_type":"Line","id":"ASB-A-376048041-c3d4ea5d","deprecated":false},{"digest":{"length":3449,"function_hash":"199300417606562923587179034825898273583"},"source":"https://android.googlesource.com/platform/frameworks/base/+/6b3066f8d199b17853992fc121f85bfa9aa43136","signature_version":"v1","signature_type":"Function","target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java","function":"onTaskAppeared"},"id":"ASB-A-376048041-c9b2afa8","deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["180219592113640461097893359970873960623","195894146686590343361764087726600971076","30689948491166592403583923642656274044","276974954893670556217485962181940104166","30514597363130404269704632993379325419","87634651897060899545778323288807035198","181711378393630417383222112923096816112","311590496053789182717998329944433641066","194924281044677760179636975132016521909","310050125723998703389278272993684594203","74372822711773720336203741019167734284","52198168245931113607322411447672367691","114341721661609098826279358073033232412","101909345364621187262183070453044962243","193678400460692395289069624140453326533","43373005389999957244497533249623070270","58463539496980679591815254265170877759","335121423655335720842034799587906370202","224737870082030916607889451494456161382","210925256920358820371288855079134919106","247069501667618065590633464510913664539","308251549669097979824626467344850405310","214208758342627681801920162758297514389","326098138363640393073588723479544544849","290599586230745918191140170592184199158","233414161293627538116823167116836083340","97691685774373846913778784202380157086","226986306722274493215689753423878442163","217937712377750734768339320193208695424","308155636303884874614400196748616084018","187675970223052046877662680865087673850","45683765107764377968434683969471188540","245553796172791036065834118837644025654","172550656236282798206579420245136799228","23463598833202747865429744302755114321","325613873942686862235563969548867158901","170656104189663599275283758039336726805","164802573160246728527776408548487646988","161029281550041250738751561158801670194","131854211668154657969872869572948724471","48391509318112473858154044798423826240","256475901771657372804955980937893007878","249740194137442961801173305405632555421","6803814013952655354307906626023491935","6058704720784170960832128907614431951","23437065534193608067251769847222532940","258207890934716088662034845783348994518","291365812812237620006593258198261989675"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/6b3066f8d199b17853992fc121f85bfa9aa43136","signature_version":"v1","signature_type":"Line","target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java"},"id":"ASB-A-376048041-d4737e28","deprecated":false},{"signature_version":"v1","digest":{"length":2712,"function_hash":"45977743421367724954429051316492832010"},"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java","function":"onTaskAppeared"},"source":"https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34","signature_type":"Function","id":"ASB-A-376048041-e2961efe","deprecated":false},{"signature_version":"v1","digest":{"length":2712,"function_hash":"45977743421367724954429051316492832010"},"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java","function":"onTaskAppeared"},"source":"https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1","signature_type":"Function","id":"ASB-A-376048041-eefb8fdd","deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1","https://android.googlesource.com/platform/frameworks/base/+/6b3066f8d199b17853992fc121f85bfa9aa43136","https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34"],"types":["EoP"],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-376048041.json"}}],"schema_version":"1.7.5"}