{"id":"ASB-A-378514614","details":"In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-378514614","CVE-2025-26428"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/afd05dc17e027734f665ac978ad6fb4584b6fd40"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"68881114488809255880383061169506138695","length":1010},"id":"ASB-A-378514614-3bd6b408","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b4945cf98c97121821c178713a613a6a6e830c3a","target":{"function":"startLockTaskMode","file":"services/core/java/com/android/server/wm/LockTaskController.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b4945cf98c97121821c178713a613a6a6e830c3a","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"line_hashes":["293398859358425972583020354542497483819","80467941493554904999700164977590972935","7513061549015014267534802234056735246","217315157243660948969603039651018798690"],"threshold":0.9},"id":"ASB-A-378514614-f5b62ae3"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b4945cf98c97121821c178713a613a6a6e830c3a"],"severity":"High","spl":"2025-05-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-378514614.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-05-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/d5268b9953765352dac09179e10836c6e481e266","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["293398859358425972583020354542497483819","80467941493554904999700164977590972935","7513061549015014267534802234056735246","217315157243660948969603039651018798690"]},"id":"ASB-A-378514614-956674a0","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/d5268b9953765352dac09179e10836c6e481e266","target":{"function":"startLockTaskMode","file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"function_hash":"150286947850126248415288695409838541637","length":992},"id":"ASB-A-378514614-bb86b438","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d5268b9953765352dac09179e10836c6e481e266"],"severity":"High","spl":"2025-05-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-378514614.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-05-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3240bf2ba1587b808b4314dd2e32c624b57c8da","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["30164921329345463907376268405083112938","80467941493554904999700164977590972935","7513061549015014267534802234056735246","217315157243660948969603039651018798690"]},"id":"ASB-A-378514614-533147e1"},{"id":"ASB-A-378514614-c9e99fce","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3240bf2ba1587b808b4314dd2e32c624b57c8da","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java","function":"startLockTaskMode"},"deprecated":false,"digest":{"function_hash":"191887681608595310044475575209842618885","length":580}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a3240bf2ba1587b808b4314dd2e32c624b57c8da"],"severity":"High","spl":"2025-05-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-378514614.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-05-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3240bf2ba1587b808b4314dd2e32c624b57c8da","target":{"file":"services/core/java/com/android/server/wm/LockTaskController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["30164921329345463907376268405083112938","80467941493554904999700164977590972935","7513061549015014267534802234056735246","217315157243660948969603039651018798690"]},"id":"ASB-A-378514614-6536628b","signature_type":"Line"},{"deprecated":false,"digest":{"length":580,"function_hash":"191887681608595310044475575209842618885"},"id":"ASB-A-378514614-fce2ab59","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a3240bf2ba1587b808b4314dd2e32c624b57c8da","target":{"function":"startLockTaskMode","file":"services/core/java/com/android/server/wm/LockTaskController.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a3240bf2ba1587b808b4314dd2e32c624b57c8da"],"severity":"High","spl":"2025-05-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-378514614.json"}}],"schema_version":"1.9.0"}