{"id":"ASB-A-407562568","details":"In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-407562568","CVE-2025-48602"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/c69e16c3efda87ee6435184949549b2f088589b3"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"digest":{"length":1970,"function_hash":"7241460862620257759575331613510376986"},"id":"ASB-A-407562568-0546cbc1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f17b66e731224605373efc27c448a048e954d663","target":{"function":"exitKeyguardAndFinishSurfaceBehindRemoteAnimation","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/f17b66e731224605373efc27c448a048e954d663","target":{"function":"handleBeforeUserSwitching","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"function_hash":"76827682085317640492417770206007998428","length":546},"id":"ASB-A-407562568-093badda","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-407562568-10e573c1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f17b66e731224605373efc27c448a048e954d663","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["108429126860948357537274543292170389621","97176192631897229311949910799081444958","133922730344520755610645367754246289317","114879154713382065371256006955323396806","154094825821043253339205705733798451099","169147459359828308322444658509850973973","219755974374221093483019226378572380507","259274666468066158807969889505466383975","202740147098715820193064097421091552602","307460358067923216688974800852580669987","150366122099979199142224801296540136317","102135582599805007200173367378260684687","267674775161265945870605957624342611620","266863325856482698085568140327246592465","79779419802409802309418625976888431071","144354207111274148470565568025575986059","12768901931424124727858832759285464686","37317416069809022492428456236584243731","328045865568541517658622850358587721633","265575614308882596499545210037248309213","89447663408169956822217983253258168420","202911584075723628845947504839999604582","9395399231686158385945055329916975534","173175738813603516002466648869213777008","33498843567045373231576015999742593313"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f17b66e731224605373efc27c448a048e954d663"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407562568.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/59a4e4f5fcdb40220a208519a8c992839a8d91e6"],"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"76827682085317640492417770206007998428","length":546},"id":"ASB-A-407562568-0f1b08ea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/59a4e4f5fcdb40220a208519a8c992839a8d91e6","target":{"function":"handleBeforeUserSwitching","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"}},{"digest":{"length":1771,"function_hash":"202069526229920072466500632854230787174"},"id":"ASB-A-407562568-42929eea","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/59a4e4f5fcdb40220a208519a8c992839a8d91e6","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"exitKeyguardAndFinishSurfaceBehindRemoteAnimation"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/59a4e4f5fcdb40220a208519a8c992839a8d91e6","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["108429126860948357537274543292170389621","97176192631897229311949910799081444958","133922730344520755610645367754246289317","114879154713382065371256006955323396806","154094825821043253339205705733798451099","169147459359828308322444658509850973973","219755974374221093483019226378572380507","259274666468066158807969889505466383975","202740147098715820193064097421091552602","2072541909723117479461697359535680470","272181877205357076225459928440872297651","265575614308882596499545210037248309213","89447663408169956822217983253258168420","156302638417916845155181859555551659114","265966947131601776221690869677159898981","308457404082208822368031778794602573555","313336724464504891254269937529122891786"]},"id":"ASB-A-407562568-b42a10da","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407562568.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08f1b10474f75ebf2b993d50993777e2853c111f","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"line_hashes":["108429126860948357537274543292170389621","97176192631897229311949910799081444958","133922730344520755610645367754246289317","114879154713382065371256006955323396806","154094825821043253339205705733798451099","169147459359828308322444658509850973973","219755974374221093483019226378572380507","259274666468066158807969889505466383975","202740147098715820193064097421091552602","307460358067923216688974800852580669987","150366122099979199142224801296540136317","102135582599805007200173367378260684687","267674775161265945870605957624342611620","266863325856482698085568140327246592465","79779419802409802309418625976888431071","242133163761301675364206706775756684183","232002761479426018424034639095206844768","2072541909723117479461697359535680470","272181877205357076225459928440872297651","265575614308882596499545210037248309213","89447663408169956822217983253258168420","202911584075723628845947504839999604582","9395399231686158385945055329916975534","173175738813603516002466648869213777008","33498843567045373231576015999742593313"],"threshold":0.9},"id":"ASB-A-407562568-37de7a3f"},{"target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"exitKeyguardAndFinishSurfaceBehindRemoteAnimation"},"deprecated":false,"digest":{"function_hash":"168360330606969228272650251753554428166","length":1888},"id":"ASB-A-407562568-97dda488","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08f1b10474f75ebf2b993d50993777e2853c111f"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/08f1b10474f75ebf2b993d50993777e2853c111f","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"handleBeforeUserSwitching"},"deprecated":false,"digest":{"length":546,"function_hash":"76827682085317640492417770206007998428"},"id":"ASB-A-407562568-9e4abdf7","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/08f1b10474f75ebf2b993d50993777e2853c111f"],"severity":"High","spl":"2026-03-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407562568.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5adb31670830e04cff3b49960875a551c1cccf0a"],"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"231374567450861248473879829509237195216","length":1952},"id":"ASB-A-407562568-32fdf838","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5adb31670830e04cff3b49960875a551c1cccf0a","target":{"function":"exitKeyguardAndFinishSurfaceBehindRemoteAnimation","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"}},{"target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"setCurrentUser"},"deprecated":false,"digest":{"function_hash":"339586397106446965437520818177228255373","length":840},"id":"ASB-A-407562568-4b04f868","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5adb31670830e04cff3b49960875a551c1cccf0a"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5adb31670830e04cff3b49960875a551c1cccf0a","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"line_hashes":["288823486499361014941068198937159355062","98235460483039653230575453223622576192","235949370961387677963331199577261396069","328935888874184870080797008435197333251","219755974374221093483019226378572380507","282029752030146130827396068310248841110","98657249708548741115416671551839586249","2072541909723117479461697359535680470","30455455226514450866123763760318583332","47857763316653466470692776714439731087","52483816978728842971284946385920496178","135633798647508570043973424889067068778","266348545204935708119013781792281451209","86635289623547260719401884955686044695","156121418211532538057031191391559831315","8650746436425999016019617655219595270","156302638417916845155181859555551659114","265966947131601776221690869677159898981","308457404082208822368031778794602573555","313336724464504891254269937529122891786"],"threshold":0.9},"id":"ASB-A-407562568-89cbd6be"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407562568.json"}}],"schema_version":"1.9.0"}