{"id":"ASB-A-408215749","details":"In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-408215749","CVE-2025-32349"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/3a76075721bb9fa7ab20bd2eb56f490a87c84f19"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/ab5874fecde66f75d74347cc1283ef40a18fc87c"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/87fc39092ca24f51b0315bd3868638289f925606","https://android.googlesource.com/platform/frameworks/base/+/7ae38300e9f79a94c0f11cb715e4ea144d4430b2"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-408215749-0b0aecbb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/87fc39092ca24f51b0315bd3868638289f925606","target":{"function":"adjustWindowParamsLw","file":"services/core/java/com/android/server/wm/DisplayPolicy.java"},"deprecated":false,"digest":{"function_hash":"46500887056697594047081537987225494204","length":2192}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["201904464568336985475915820382324790951","13409443471544318719523490892523778773","161429973723354732237531759415663007175","204896755140344046184406651827807789088","177786852814562046750704862933132913670","224903445534682219461979944206426606234","196929720538350313905126156108196069165","268287909900336032225051752572017840251"]},"id":"ASB-A-408215749-2b752f06","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae38300e9f79a94c0f11cb715e4ea144d4430b2","target":{"file":"services/core/java/com/android/server/wm/WindowStateAnimator.java"}},{"target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"show"},"deprecated":false,"digest":{"length":1089,"function_hash":"37431220966573520822792011219162230728"},"id":"ASB-A-408215749-3d926a70","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae38300e9f79a94c0f11cb715e4ea144d4430b2"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae38300e9f79a94c0f11cb715e4ea144d4430b2","target":{"function":"setForceHideNonSystemOverlayWindowIfNeeded","file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"function_hash":"251447601166105229831861779513441982273","length":484},"id":"ASB-A-408215749-4c72ff7d","match_only_versions":["16-next"],"signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"61524713928084145603339191318704785534","length":2122},"id":"ASB-A-408215749-9bbf35a8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae38300e9f79a94c0f11cb715e4ea144d4430b2","target":{"function":"applyAnimationLocked","file":"services/core/java/com/android/server/wm/WindowStateAnimator.java"}},{"deprecated":false,"digest":{"line_hashes":["320754921325045158968841410801028327418","338094196989045123015778296998651767460","124568455449675093228614837996088111862","117240680202406064317653442700771351587"],"threshold":0.9},"id":"ASB-A-408215749-a2d1602a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/87fc39092ca24f51b0315bd3868638289f925606","target":{"file":"services/core/java/com/android/server/wm/DisplayPolicy.java"}},{"match_only_versions":["16-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae38300e9f79a94c0f11cb715e4ea144d4430b2","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["35429178940830642502817207684304243955","263272723815670162719720692488140673330","189874878780797538245576943630330796945","13143600611355226543544112867922053881","219032621354172057005128545093160906774","115775729929352913913127422595172458075","192181545258573237909329569346894302152","223944512126736607994667331090945106537","96710653856505510310639285268304304599","210559563236711244457527744616947491883","246055486246453523772316401094440088212","77875204097083182055750013565738768243","260572653997723997123599115687806276635","226026519274057475327378688547446868339","1865106637846982979685510115795519695","84496464945246677191339651709368343114","272408033335267253512309867365715041817","138198184166265904476844571551865472746","43544052685817852905573236264732704112","65534544606542973141701575900721904688","185550145377147174567006554256878819863","5239671405444312160800972798884835114","197303950902900701094491863680924688559","335022905788292818145022105949807708443","281323032756614960151897266509943740947","288041968318694665354907527628918590833"]},"id":"ASB-A-408215749-c4177f93"},{"id":"ASB-A-408215749-edce22a4","match_only_versions":["16-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7ae38300e9f79a94c0f11cb715e4ea144d4430b2","target":{"function":"dump","file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"function_hash":"149830983188146527952979266623709921034","length":6279}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-408215749.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cc347f9a90c634df7ff97034bf8d963309a57270","https://android.googlesource.com/platform/frameworks/base/+/f9e077f0cc622d2aa45bf43354dff23a9dcc01a3"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":2113,"function_hash":"108612950539620076039599339969581573895"},"id":"ASB-A-408215749-208ed0dd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cc347f9a90c634df7ff97034bf8d963309a57270","target":{"file":"services/core/java/com/android/server/wm/WindowStateAnimator.java","function":"applyAnimationLocked"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/cc347f9a90c634df7ff97034bf8d963309a57270","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["96710653856505510310639285268304304599","210559563236711244457527744616947491883","246055486246453523772316401094440088212"]},"id":"ASB-A-408215749-45fb54c8","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/f9e077f0cc622d2aa45bf43354dff23a9dcc01a3","target":{"file":"services/core/java/com/android/server/wm/DisplayPolicy.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["320754921325045158968841410801028327418","338094196989045123015778296998651767460","124568455449675093228614837996088111862","117240680202406064317653442700771351587"]},"id":"ASB-A-408215749-7332504f","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"46500887056697594047081537987225494204","length":2192},"id":"ASB-A-408215749-9352553f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f9e077f0cc622d2aa45bf43354dff23a9dcc01a3","target":{"file":"services/core/java/com/android/server/wm/DisplayPolicy.java","function":"adjustWindowParamsLw"}},{"target":{"file":"services/core/java/com/android/server/wm/WindowStateAnimator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["201904464568336985475915820382324790951","13409443471544318719523490892523778773","161429973723354732237531759415663007175","303675762840867187450162922118427436341","177786852814562046750704862933132913670","224903445534682219461979944206426606234","196929720538350313905126156108196069165","268287909900336032225051752572017840251"]},"id":"ASB-A-408215749-d3cec7cc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cc347f9a90c634df7ff97034bf8d963309a57270"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-408215749.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/74eb0ec676f23bad95f06b0a4ee559dafc2fb22a","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["96710653856505510310639285268304304599","210559563236711244457527744616947491883","246055486246453523772316401094440088212"],"threshold":0.9},"id":"ASB-A-408215749-010d0a49","signature_type":"Line","signature_version":"v1"},{"digest":{"length":2122,"function_hash":"61524713928084145603339191318704785534"},"id":"ASB-A-408215749-01bbd964","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/74eb0ec676f23bad95f06b0a4ee559dafc2fb22a","target":{"file":"services/core/java/com/android/server/wm/WindowStateAnimator.java","function":"applyAnimationLocked"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/74eb0ec676f23bad95f06b0a4ee559dafc2fb22a","target":{"file":"services/core/java/com/android/server/wm/WindowStateAnimator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["201904464568336985475915820382324790951","13409443471544318719523490892523778773","161429973723354732237531759415663007175","204896755140344046184406651827807789088","177786852814562046750704862933132913670","224903445534682219461979944206426606234","196929720538350313905126156108196069165","268287909900336032225051752572017840251"]},"id":"ASB-A-408215749-2c2fa026"},{"deprecated":false,"digest":{"length":2192,"function_hash":"46500887056697594047081537987225494204"},"id":"ASB-A-408215749-6e747c82","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ad7120e1c45b9c2eb301d9cb54e18f4e2a5b839c","target":{"file":"services/core/java/com/android/server/wm/DisplayPolicy.java","function":"adjustWindowParamsLw"}},{"deprecated":false,"digest":{"line_hashes":["320754921325045158968841410801028327418","338094196989045123015778296998651767460","124568455449675093228614837996088111862","117240680202406064317653442700771351587"],"threshold":0.9},"id":"ASB-A-408215749-f2434a31","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ad7120e1c45b9c2eb301d9cb54e18f4e2a5b839c","target":{"file":"services/core/java/com/android/server/wm/DisplayPolicy.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/74eb0ec676f23bad95f06b0a4ee559dafc2fb22a","https://android.googlesource.com/platform/frameworks/base/+/ad7120e1c45b9c2eb301d9cb54e18f4e2a5b839c"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-408215749.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-408215749-905c9c88","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3beed7b34e54f2147aef9e9e5bbb413527b399fa","target":{"file":"services/core/java/com/android/server/wm/DisplayPolicy.java"},"deprecated":false,"digest":{"line_hashes":["320754921325045158968841410801028327418","338094196989045123015778296998651767460","124568455449675093228614837996088111862","117240680202406064317653442700771351587"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["96710653856505510310639285268304304599","210559563236711244457527744616947491883","246055486246453523772316401094440088212"],"threshold":0.9},"id":"ASB-A-408215749-a492552d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dd71ab6ba3950978bd28dc38fecec236cf1153ea","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/dd71ab6ba3950978bd28dc38fecec236cf1153ea","target":{"file":"services/core/java/com/android/server/wm/WindowStateAnimator.java"},"deprecated":false,"digest":{"line_hashes":["201904464568336985475915820382324790951","13409443471544318719523490892523778773","161429973723354732237531759415663007175","17815163004452760008631732071102879758","177786852814562046750704862933132913670","224903445534682219461979944206426606234","196929720538350313905126156108196069165","268287909900336032225051752572017840251"],"threshold":0.9},"id":"ASB-A-408215749-c15d8946","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-408215749-c3568d43","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dd71ab6ba3950978bd28dc38fecec236cf1153ea","target":{"file":"services/core/java/com/android/server/wm/WindowStateAnimator.java","function":"applyAnimationLocked"},"deprecated":false,"digest":{"length":2120,"function_hash":"265827318803707599257587124524610229685"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3beed7b34e54f2147aef9e9e5bbb413527b399fa","target":{"file":"services/core/java/com/android/server/wm/DisplayPolicy.java","function":"adjustWindowParamsLw"},"deprecated":false,"digest":{"function_hash":"274602194768783411514126977244299952776","length":2391},"id":"ASB-A-408215749-cf4a94d6"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dd71ab6ba3950978bd28dc38fecec236cf1153ea","https://android.googlesource.com/platform/frameworks/base/+/3beed7b34e54f2147aef9e9e5bbb413527b399fa"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-408215749.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/DisplayPolicy.java"},"deprecated":false,"digest":{"line_hashes":["320754921325045158968841410801028327418","338094196989045123015778296998651767460","124568455449675093228614837996088111862","117240680202406064317653442700771351587"],"threshold":0.9},"id":"ASB-A-408215749-30bca6b1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3beed7b34e54f2147aef9e9e5bbb413527b399fa"},{"digest":{"function_hash":"274602194768783411514126977244299952776","length":2391},"id":"ASB-A-408215749-5a741370","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/3beed7b34e54f2147aef9e9e5bbb413527b399fa","target":{"function":"adjustWindowParamsLw","file":"services/core/java/com/android/server/wm/DisplayPolicy.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/dd71ab6ba3950978bd28dc38fecec236cf1153ea","target":{"file":"services/core/java/com/android/server/wm/WindowStateAnimator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["201904464568336985475915820382324790951","13409443471544318719523490892523778773","161429973723354732237531759415663007175","17815163004452760008631732071102879758","177786852814562046750704862933132913670","224903445534682219461979944206426606234","196929720538350313905126156108196069165","268287909900336032225051752572017840251"]},"id":"ASB-A-408215749-a86e38de","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["96710653856505510310639285268304304599","210559563236711244457527744616947491883","246055486246453523772316401094440088212"]},"id":"ASB-A-408215749-a98e3ff9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dd71ab6ba3950978bd28dc38fecec236cf1153ea","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}},{"id":"ASB-A-408215749-e3748cd0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dd71ab6ba3950978bd28dc38fecec236cf1153ea","target":{"file":"services/core/java/com/android/server/wm/WindowStateAnimator.java","function":"applyAnimationLocked"},"deprecated":false,"digest":{"length":2120,"function_hash":"265827318803707599257587124524610229685"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dd71ab6ba3950978bd28dc38fecec236cf1153ea","https://android.googlesource.com/platform/frameworks/base/+/3beed7b34e54f2147aef9e9e5bbb413527b399fa"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-408215749.json"}}],"schema_version":"1.9.0"}