{"id":"ASB-A-405392600","details":"In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-405392600","CVE-2026-0036"],"modified":"2026-06-10T14:58:40.911641763Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["ID"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3be8f7ff61baa3a98320de393a94735aecc6e77c"],"severity":"High","vanir_signatures":[{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java","function":"startAnimation"},"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3be8f7ff61baa3a98320de393a94735aecc6e77c","deprecated":false,"id":"ASB-A-405392600-a4d2eec2","digest":{"function_hash":"307110352914677260204125420269224047833","length":5314}},{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3be8f7ff61baa3a98320de393a94735aecc6e77c","deprecated":false,"id":"ASB-A-405392600-e938b26c","digest":{"line_hashes":["196834800934499512401249703690353402776","53800243681986578973638540609664851654","30945154683274107557620767714865022409","25920037041630569851527813329817975309","264753023589251046938758459268495951557","92360547457962659164697384821767116808","278944544124777527876046268260362601255","192914089220059111923475337081443309263","85118904142547979141340432401522893834"],"threshold":0.9}}],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-405392600.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["ID"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541"],"vanir_signatures":[{"deprecated":false,"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541","target":{"function":"StageCoordinator","file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"id":"ASB-A-405392600-289391f0","digest":{"function_hash":"200256576980199633511250134072010924083","length":959}},{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541","deprecated":false,"id":"ASB-A-405392600-3bedab9e","digest":{"line_hashes":["94499919690297704469328890313529712110","223644107047342772176529808333539353932","61693059786144883367462358733407368842","74027056211580294426523386286213487092","220784762026793465380558929547702214099","154314517670998619360208194434236507315","143454919783250357699654915245625515593","67690817930865624100864444597899473908","321025809858375577747017341072559954411","68731163320469398113454798746270171375","302011751558441188943875649047930433626","249566287001256496614460919273593129073","96830722721993081390165605108868332262","212366543043209844071033670495621796210","302011751558441188943875649047930433626","194171177533092460531665981216334981725","254478536588815336192906194395773505676","38005616853806467836966517160243520536","69532484967583811878219865071959654805","43687536184342139642152867007761407322"],"threshold":0.9}},{"target":{"function":"StageCoordinator","file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541","deprecated":false,"id":"ASB-A-405392600-6cbb4ea7","digest":{"function_hash":"11177246840131358714967682356840276912","length":1547}},{"target":{"function":"startAnimation","file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541","deprecated":false,"id":"ASB-A-405392600-70f41a58","digest":{"function_hash":"119816627596400220211526870256072744673","length":3727}},{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageTaskListener.java"},"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541","deprecated":false,"id":"ASB-A-405392600-e5d91ec0","digest":{"line_hashes":["332514508025218394710007622616753523075","339386023105424134433422368575210967105","119757193032673000187464040791551055017","213574414285756692981460083597306495482"],"threshold":0.9}}],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-405392600.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["ID"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/260c1e81ccaee07cac1bc8de20187f44f343f09d"],"severity":"High","vanir_signatures":[{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/260c1e81ccaee07cac1bc8de20187f44f343f09d","deprecated":false,"id":"ASB-A-405392600-1f37694f","digest":{"line_hashes":["196834800934499512401249703690353402776","53800243681986578973638540609664851654","39882914833753962973421883567473073341","170978874624033054880904752284089797686","264753023589251046938758459268495951557","92360547457962659164697384821767116808","278944544124777527876046268260362601255","192914089220059111923475337081443309263","85118904142547979141340432401522893834"],"threshold":0.9}},{"target":{"function":"startAnimation","file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/260c1e81ccaee07cac1bc8de20187f44f343f09d","deprecated":false,"id":"ASB-A-405392600-7f699025","digest":{"function_hash":"306008240040097613830486535496724852458","length":5331}}],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-405392600.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["ID"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/8e2cb82b544c443312d6d229e67bcf3d2cd56843"],"vanir_signatures":[{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8e2cb82b544c443312d6d229e67bcf3d2cd56843","deprecated":false,"id":"ASB-A-405392600-d8d99611","digest":{"line_hashes":["196834800934499512401249703690353402776","53800243681986578973638540609664851654","30945154683274107557620767714865022409","25920037041630569851527813329817975309","264753023589251046938758459268495951557","92360547457962659164697384821767116808","278944544124777527876046268260362601255","192914089220059111923475337081443309263","85118904142547979141340432401522893834"],"threshold":0.9}},{"target":{"function":"startAnimation","file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8e2cb82b544c443312d6d229e67bcf3d2cd56843","deprecated":false,"id":"ASB-A-405392600-d94921a8","digest":{"function_hash":"10986556182857700889922712942182990819","length":5474}}],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-405392600.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["ID"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841"],"vanir_signatures":[{"target":{"function":"startAnimation","file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841","deprecated":false,"id":"ASB-A-405392600-2ac0e4ba","digest":{"function_hash":"96258137169049472265897891995057180961","length":3114}},{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageTaskListener.java"},"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841","deprecated":false,"id":"ASB-A-405392600-4bde0776","digest":{"line_hashes":["242287264711416719263041639547230489040","153455352669136730683556758107487076414","119757193032673000187464040791551055017","213574414285756692981460083597306495482"],"threshold":0.9}},{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java","function":"StageCoordinator"},"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841","deprecated":false,"id":"ASB-A-405392600-d78e6556","digest":{"function_hash":"233077854123749515899633287732957235013","length":1322}},{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java","function":"StageCoordinator"},"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841","deprecated":false,"id":"ASB-A-405392600-f6bffd82","digest":{"function_hash":"206903133592589499782802830159529961002","length":863}},{"target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"},"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841","deprecated":false,"id":"ASB-A-405392600-fb40d545","digest":{"line_hashes":["271049556893542636157167826222580523104","188606234207985012251090737069440151640","36984586390521816650608175486469870898","119519604842057829123414476545095272719","96691153340318844249998119179124601413","33206300867112779391273574561610251391","61693059786144883367462358733407368842","74027056211580294426523386286213487092","170202074854778136268736953150312446955","173612082838792809985396654531375628867","292585950027804735890917845702517712905","183839358493519301610242601473229862753","321025809858375577747017341072559954411","68731163320469398113454798746270171375","302011751558441188943875649047930433626","249566287001256496614460919273593129073","76922199718685550758807023169323586217","79069259876957789821402893829705789471","302011751558441188943875649047930433626","194171177533092460531665981216334981725","254478536588815336192906194395773505676","80780765245875944920230006771042030477","275529923052970153285405197698653732853","258716876955811455083242805139591387377"],"threshold":0.9}}],"spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-405392600.json"}}],"schema_version":"1.7.5"}