{"id":"ASB-A-406243581","details":"In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-406243581","CVE-2025-48634"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/d550a457e65ccbbf252ec2e60d93e8bcd111de0e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ec6a92be6c93173fb5c61f95ff92e0f68fe0e951","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["112583862987529910522567824721871660130","189728754272288778320140357092676926841","140678696297236203857523858943838595476","291509775819964769957008111257006813343","229568372283406239577373304007358426862","189414961804717561348112178889594480441","180903832185307819131027470734712313519"]},"id":"ASB-A-406243581-ed215e81","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ec6a92be6c93173fb5c61f95ff92e0f68fe0e951","target":{"function":"relayoutWindow","file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false,"digest":{"function_hash":"279581721051398527638503601821170503552","length":11635},"id":"ASB-A-406243581-f4c2e690","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ec6a92be6c93173fb5c61f95ff92e0f68fe0e951"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-406243581.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/29c46c3d650fb67ff933fc6c904d15014158b332","https://android.googlesource.com/platform/frameworks/base/+/5714f42fb1a1ba2fc2c04d56bb979e07fe19b8b2"],"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"206320670549241016482915091670925069494","length":10959},"id":"ASB-A-406243581-6fa0a613","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/29c46c3d650fb67ff933fc6c904d15014158b332","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"relayoutWindowInner"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["112583862987529910522567824721871660130","189728754272288778320140357092676926841","140678696297236203857523858943838595476","291509775819964769957008111257006813343","258875520015750802158282843496210785025","92206392459357694396348100288410649378","286176192243987583194537110423231071488"],"threshold":0.9},"id":"ASB-A-406243581-ce0956fd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/29c46c3d650fb67ff933fc6c904d15014158b332","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-406243581.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3d9b1584cee3013a374b4bfbcd7a3a75723d5379"],"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["112583862987529910522567824721871660130","189728754272288778320140357092676926841","140678696297236203857523858943838595476","291509775819964769957008111257006813343","258875520015750802158282843496210785025","92206392459357694396348100288410649378","286176192243987583194537110423231071488"],"threshold":0.9},"id":"ASB-A-406243581-5525f276","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3d9b1584cee3013a374b4bfbcd7a3a75723d5379","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3d9b1584cee3013a374b4bfbcd7a3a75723d5379","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"relayoutWindow"},"deprecated":false,"digest":{"function_hash":"94430360263907152526751612673174960663","length":10749},"id":"ASB-A-406243581-7d995324","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-406243581.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3493e4a41abf3fcb8b41450a8a2e8bcf9190d1e3","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java","function":"relayoutWindow"},"deprecated":false,"digest":{"function_hash":"28785521871887049764891649859350298238","length":10179},"id":"ASB-A-406243581-9f1ff602","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["112583862987529910522567824721871660130","189728754272288778320140357092676926841","295516143435131289960592876169986754761","232869217442341220934629217606644293733","258875520015750802158282843496210785025","9581110405437095469757627657481320544","104224205874430344868761495841613970321"],"threshold":0.9},"id":"ASB-A-406243581-f2a1a216","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3493e4a41abf3fcb8b41450a8a2e8bcf9190d1e3","target":{"file":"services/core/java/com/android/server/wm/WindowManagerService.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3493e4a41abf3fcb8b41450a8a2e8bcf9190d1e3"],"severity":"High","spl":"2026-03-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-406243581.json"}}],"schema_version":"1.9.0"}