{"id":"ASB-A-438973280","details":"In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-438973280","CVE-2025-48616"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/aa9fbb1b74eb11ce0bd48f0c4cab43fc32a23b4e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"doKeyguardLocked"},"deprecated":false,"digest":{"length":2920,"function_hash":"62065052189309584053778982792654750880"},"id":"ASB-A-438973280-254fedbb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"setKeyguardEnabled"},"deprecated":false,"digest":{"function_hash":"187740487069481619775985710964898753634","length":1312},"id":"ASB-A-438973280-5675988f","signature_type":"Function","signature_version":"v1"},{"target":{"function":"onStrongAuthStateChanged","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"function_hash":"144717035925538850326922822744760286648","length":205},"id":"ASB-A-438973280-5de8e2bd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"line_hashes":["209003653409485814053874828966339831762","248157843896045004288509290425769454425","295819614806895111282634632024505080583","33054126993467952584247571675358090874","157308877314888095909473701707830601155","302452540552734798692213935741771649446","178207226253972502873616493127000158293","1163217655246275190591404310621043494","320063222130511664022688046149485038347","63286039853862214767875888942314506820","38851795789724782623423941453576972444","289951149868027652041402854077089503975"],"threshold":0.9},"id":"ASB-A-438973280-8d5adee9","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651"],"severity":"High","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10","target":{"function":"setKeyguardEnabled","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"length":1312,"function_hash":"187740487069481619775985710964898753634"},"id":"ASB-A-438973280-1237e20a","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"9534616859167290042442020910009650438","length":2458},"id":"ASB-A-438973280-3e50391a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"doKeyguardLocked"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10","target":{"function":"onStrongAuthStateChanged","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"function_hash":"136313731282049621704943676923449853035","length":137},"id":"ASB-A-438973280-7fbb6a41"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["328443085910941181851152407178313554967","35067794694172749795438568066573731753","218896132632949222370235331652783459150","33054126993467952584247571675358090874","157308877314888095909473701707830601155","302452540552734798692213935741771649446","178207226253972502873616493127000158293","1163217655246275190591404310621043494","320063222130511664022688046149485038347","63286039853862214767875888942314506820","38851795789724782623423941453576972444","289951149868027652041402854077089503975"]},"id":"ASB-A-438973280-a39d99f7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"136313731282049621704943676923449853035","length":137},"id":"ASB-A-438973280-6b93965b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"onStrongAuthStateChanged"}},{"digest":{"function_hash":"187740487069481619775985710964898753634","length":1312},"id":"ASB-A-438973280-cbdb6460","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905","target":{"function":"setKeyguardEnabled","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["328443085910941181851152407178313554967","35067794694172749795438568066573731753","218896132632949222370235331652783459150","33054126993467952584247571675358090874","157308877314888095909473701707830601155","302452540552734798692213935741771649446","178207226253972502873616493127000158293","1163217655246275190591404310621043494","320063222130511664022688046149485038347","63286039853862214767875888942314506820","38851795789724782623423941453576972444","289951149868027652041402854077089503975"],"threshold":0.9},"id":"ASB-A-438973280-ed8aa31e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"doKeyguardLocked"},"deprecated":false,"digest":{"function_hash":"19444794359538423208616869984122610262","length":2787},"id":"ASB-A-438973280-f05f514a","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-06-01","types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"62065052189309584053778982792654750880","length":2920},"id":"ASB-A-438973280-250f3531","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"doKeyguardLocked"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["209003653409485814053874828966339831762","248157843896045004288509290425769454425","295819614806895111282634632024505080583","33054126993467952584247571675358090874","157308877314888095909473701707830601155","302452540552734798692213935741771649446","178207226253972502873616493127000158293","1163217655246275190591404310621043494","320063222130511664022688046149485038347","63286039853862214767875888942314506820","38851795789724782623423941453576972444","289951149868027652041402854077089503975"]},"id":"ASB-A-438973280-2d0a3a4b"},{"target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"setKeyguardEnabled"},"deprecated":false,"digest":{"function_hash":"187740487069481619775985710964898753634","length":1312},"id":"ASB-A-438973280-7f0e9bc5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26"},{"id":"ASB-A-438973280-8ffb71c3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"onStrongAuthStateChanged"},"deprecated":false,"digest":{"length":205,"function_hash":"144717035925538850326922822744760286648"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-06-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"doKeyguardLocked"},"deprecated":false,"digest":{"length":2452,"function_hash":"28355018146740837997510255390809824199"},"id":"ASB-A-438973280-0fe5ac68","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc","target":{"function":"setKeyguardEnabled","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"function_hash":"74706416706882606468745504616270143627","length":1310},"id":"ASB-A-438973280-72be80c2","signature_type":"Function"},{"id":"ASB-A-438973280-8e51eb3f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"deprecated":false,"digest":{"line_hashes":["38867570063675643553038483487100176832","163776543271928782038002134823982461851","199000920925165640654848569466156005191","215446848326935019446492765767272069821","32506973252840195140735957884626071389","12350634736937558266771328155721071284","199432919809092178067366540515146144839","280601339876405487838658475878899190765","220569421737926242352480083075105166400","315734703629131880403629904844485908198","223781247095430728760283417532866046923","190167032595858610910918531959616276798"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java","function":"onStrongAuthStateChanged"},"deprecated":false,"digest":{"function_hash":"286915552132051646324387458920861407957","length":135},"id":"ASB-A-438973280-c391b580","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}}],"schema_version":"1.9.0"}