{"id":"ASB-A-438973280","details":"In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-438973280","CVE-2025-48616"],"modified":"2026-06-09T15:27:06.151355248Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/aa9fbb1b74eb11ce0bd48f0c4cab43fc32a23b4e"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["ID"],"spl":"2026-06-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651","target":{"function":"doKeyguardLocked","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_version":"v1","id":"ASB-A-438973280-254fedbb","signature_type":"Function","digest":{"function_hash":"62065052189309584053778982792654750880","length":2920},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651","target":{"function":"setKeyguardEnabled","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_version":"v1","id":"ASB-A-438973280-5675988f","signature_type":"Function","digest":{"function_hash":"187740487069481619775985710964898753634","length":1312},"deprecated":false},{"id":"ASB-A-438973280-5de8e2bd","target":{"function":"onStrongAuthStateChanged","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651","signature_version":"v1","signature_type":"Function","digest":{"function_hash":"144717035925538850326922822744760286648","length":205},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_version":"v1","id":"ASB-A-438973280-8d5adee9","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["209003653409485814053874828966339831762","248157843896045004288509290425769454425","295819614806895111282634632024505080583","33054126993467952584247571675358090874","157308877314888095909473701707830601155","302452540552734798692213935741771649446","178207226253972502873616493127000158293","1163217655246275190591404310621043494","320063222130511664022688046149485038347","63286039853862214767875888942314506820","38851795789724782623423941453576972444","289951149868027652041402854077089503975"]},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["ID"],"spl":"2026-06-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10"],"vanir_signatures":[{"signature_type":"Function","target":{"function":"setKeyguardEnabled","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"id":"ASB-A-438973280-1237e20a","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10","digest":{"function_hash":"187740487069481619775985710964898753634","length":1312},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10","target":{"function":"doKeyguardLocked","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_version":"v1","id":"ASB-A-438973280-3e50391a","signature_type":"Function","digest":{"function_hash":"9534616859167290042442020910009650438","length":2458},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10","target":{"function":"onStrongAuthStateChanged","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_version":"v1","id":"ASB-A-438973280-7fbb6a41","signature_type":"Function","digest":{"function_hash":"136313731282049621704943676923449853035","length":137},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_version":"v1","id":"ASB-A-438973280-a39d99f7","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["328443085910941181851152407178313554967","35067794694172749795438568066573731753","218896132632949222370235331652783459150","33054126993467952584247571675358090874","157308877314888095909473701707830601155","302452540552734798692213935741771649446","178207226253972502873616493127000158293","1163217655246275190591404310621043494","320063222130511664022688046149485038347","63286039853862214767875888942314506820","38851795789724782623423941453576972444","289951149868027652041402854077089503975"]},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["ID"],"spl":"2026-06-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905","target":{"function":"onStrongAuthStateChanged","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_version":"v1","id":"ASB-A-438973280-6b93965b","signature_type":"Function","digest":{"function_hash":"136313731282049621704943676923449853035","length":137},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905","target":{"function":"setKeyguardEnabled","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_version":"v1","id":"ASB-A-438973280-cbdb6460","signature_type":"Function","digest":{"function_hash":"187740487069481619775985710964898753634","length":1312},"deprecated":false},{"signature_type":"Line","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"id":"ASB-A-438973280-ed8aa31e","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905","digest":{"threshold":0.9,"line_hashes":["328443085910941181851152407178313554967","35067794694172749795438568066573731753","218896132632949222370235331652783459150","33054126993467952584247571675358090874","157308877314888095909473701707830601155","302452540552734798692213935741771649446","178207226253972502873616493127000158293","1163217655246275190591404310621043494","320063222130511664022688046149485038347","63286039853862214767875888942314506820","38851795789724782623423941453576972444","289951149868027652041402854077089503975"]},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905","target":{"function":"doKeyguardLocked","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_version":"v1","id":"ASB-A-438973280-f05f514a","signature_type":"Function","digest":{"function_hash":"19444794359538423208616869984122610262","length":2787},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["ID"],"spl":"2026-06-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26"],"vanir_signatures":[{"signature_type":"Function","target":{"function":"doKeyguardLocked","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"id":"ASB-A-438973280-250f3531","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26","digest":{"function_hash":"62065052189309584053778982792654750880","length":2920},"deprecated":false},{"signature_version":"v1","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_type":"Line","id":"ASB-A-438973280-2d0a3a4b","source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26","digest":{"threshold":0.9,"line_hashes":["209003653409485814053874828966339831762","248157843896045004288509290425769454425","295819614806895111282634632024505080583","33054126993467952584247571675358090874","157308877314888095909473701707830601155","302452540552734798692213935741771649446","178207226253972502873616493127000158293","1163217655246275190591404310621043494","320063222130511664022688046149485038347","63286039853862214767875888942314506820","38851795789724782623423941453576972444","289951149868027652041402854077089503975"]},"deprecated":false},{"signature_type":"Function","target":{"function":"setKeyguardEnabled","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"id":"ASB-A-438973280-7f0e9bc5","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26","digest":{"function_hash":"187740487069481619775985710964898753634","length":1312},"deprecated":false},{"signature_version":"v1","target":{"function":"onStrongAuthStateChanged","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"signature_type":"Function","id":"ASB-A-438973280-8ffb71c3","source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26","digest":{"function_hash":"144717035925538850326922822744760286648","length":205},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["ID"],"spl":"2026-06-01","severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc"],"vanir_signatures":[{"signature_type":"Function","target":{"function":"doKeyguardLocked","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"id":"ASB-A-438973280-0fe5ac68","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc","digest":{"function_hash":"28355018146740837997510255390809824199","length":2452},"deprecated":false},{"id":"ASB-A-438973280-72be80c2","target":{"function":"setKeyguardEnabled","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc","signature_version":"v1","signature_type":"Function","digest":{"function_hash":"74706416706882606468745504616270143627","length":1310},"deprecated":false},{"id":"ASB-A-438973280-8e51eb3f","target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc","signature_version":"v1","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["38867570063675643553038483487100176832","163776543271928782038002134823982461851","199000920925165640654848569466156005191","215446848326935019446492765767272069821","32506973252840195140735957884626071389","12350634736937558266771328155721071284","199432919809092178067366540515146144839","280601339876405487838658475878899190765","220569421737926242352480083075105166400","315734703629131880403629904844485908198","223781247095430728760283417532866046923","190167032595858610910918531959616276798"]},"deprecated":false},{"id":"ASB-A-438973280-c391b580","target":{"function":"onStrongAuthStateChanged","file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc","signature_version":"v1","signature_type":"Function","digest":{"function_hash":"286915552132051646324387458920861407957","length":135},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"}}],"schema_version":"1.7.5"}