{"id":"ASB-A-464526458","details":"In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-464526458","CVE-2026-0065"],"modified":"2026-09-08T15:39:03.104189951Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["73046504618660582395574844777253315374","330387405518780465397403390363762478756","215890888295206688476670566225914578557","180800775238810118100131782244407644837"]},"id":"ASB-A-464526458-0b7141e4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682","target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java","function":"areBackgroundActivityStartsAllowed"},"deprecated":false,"digest":{"function_hash":"143380978350973373013440701584546112244","length":1324},"id":"ASB-A-464526458-2cfca4f6","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false,"digest":{"line_hashes":["146769040500021787528545105549259973868","182325258103073499909270517816673883219","284864839436383791561624235069037153809","211660263292507573797006478975017090501","283708962198578721655982350975381204609","151246692116000714145758709506519188041","75764128462750765707573704157076991346","49209169815236049901648328848139260706","228649580167071546740086712885126606374","116817328366553531740104663848123646376","175762470153445334763409674220116161417","70263026317357662030265406059344814676","149936038488966642756316536744704199116","178498502371138113737600816739126287684","110422244730757250624945615794147314957","238280979789010909138282512357853600217","72876531201846381436074926870788598644","293250796321213382903584523752051680385","231912993505126684309873105459441858933","138958301752926086560920109173342050953","58838867726842286788809732133561429456"],"threshold":0.9},"id":"ASB-A-464526458-981fbdad"},{"id":"ASB-A-464526458-a4284d5d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682","target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java","function":"WindowProcessController"},"deprecated":false,"digest":{"function_hash":"47341408136498732326287502129607834834","length":674}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682","target":{"function":"isBoundByForegroundUid","file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false,"digest":{"length":315,"function_hash":"197684456420924789431075614136860390978"},"id":"ASB-A-464526458-ace83611","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"314235660009376757178028004664370744928","length":152},"id":"ASB-A-464526458-f4a2a9fd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java","function":"BackgroundLaunchProcessController"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-464526458.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-464526458-274ec9e4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["99162038471083773699272782685744667264","80205655137540829656108104452242663589","314235919336652542099470259239881947604","326415240541677075291145333357835595569","269919879288557531431549615596513720539","102857065816403933007667912064713155348","284864839436383791561624235069037153809","211660263292507573797006478975017090501","283708962198578721655982350975381204609","151246692116000714145758709506519188041","75764128462750765707573704157076991346","49209169815236049901648328848139260706","105883670696038004159354055967862803339","255984591127679450019907135772877356305","58866903693935143842157161898770863212","257277103302453843338359185206915243115","248545751631401845904730627242372349412","9047606762293242906155535157480681504","264194205621035045373163381903991372408","142117258438042846578136794806834282324","98223113605773475332000554373383288748","178498502371138113737600816739126287684","110422244730757250624945615794147314957","238280979789010909138282512357853600217","72876531201846381436074926870788598644","293250796321213382903584523752051680385","231912993505126684309873105459441858933","138958301752926086560920109173342050953","58838867726842286788809732133561429456"]}},{"deprecated":false,"digest":{"function_hash":"197684456420924789431075614136860390978","length":315},"id":"ASB-A-464526458-33be2fa7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195","target":{"function":"isBoundByForegroundUid","file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"}},{"id":"ASB-A-464526458-5d723dbd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195","target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java","function":"WindowProcessController"},"deprecated":false,"digest":{"length":795,"function_hash":"254180117488952461526885384663677660079"}},{"target":{"function":"areBackgroundActivityStartsAllowed","file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false,"digest":{"function_hash":"127515804240571674148418957220075186992","length":1388},"id":"ASB-A-464526458-86a80a9e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java","function":"BackgroundLaunchProcessController"},"deprecated":false,"digest":{"length":152,"function_hash":"314235660009376757178028004664370744928"},"id":"ASB-A-464526458-940cb9e0"},{"target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"},"deprecated":false,"digest":{"line_hashes":["73046504618660582395574844777253315374","330387405518780465397403390363762478756","215890888295206688476670566225914578557","180800775238810118100131782244407644837"],"threshold":0.9},"id":"ASB-A-464526458-a7e97c5c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195","https://android.googlesource.com/platform/frameworks/base/+/66e70ef81382ada56496c7bc4225eb4a5e84e248"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-464526458.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87","https://android.googlesource.com/platform/frameworks/base/+/e26dda735b99edd974444462ce5b333dbbd3aa6a"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java","function":"isBoundByForegroundUid"},"deprecated":false,"digest":{"function_hash":"197684456420924789431075614136860390978","length":315},"id":"ASB-A-464526458-0dd0400d","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87","target":{"function":"WindowProcessController","file":"services/core/java/com/android/server/wm/WindowProcessController.java"},"deprecated":false,"digest":{"function_hash":"47341408136498732326287502129607834834","length":674},"id":"ASB-A-464526458-6573dc35","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["269919879288557531431549615596513720539","102857065816403933007667912064713155348","284864839436383791561624235069037153809","211660263292507573797006478975017090501","283708962198578721655982350975381204609","151246692116000714145758709506519188041","75764128462750765707573704157076991346","49209169815236049901648328848139260706","228649580167071546740086712885126606374","116817328366553531740104663848123646376","122376956380815320468047852860214196351","234894974799769630399468878050193128926","160058135940036580118892726299854706698","178498502371138113737600816739126287684","110422244730757250624945615794147314957","238280979789010909138282512357853600217","72876531201846381436074926870788598644","293250796321213382903584523752051680385","231912993505126684309873105459441858933","138958301752926086560920109173342050953","58838867726842286788809732133561429456"]},"id":"ASB-A-464526458-672743d1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87","target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"},"deprecated":false,"digest":{"line_hashes":["73046504618660582395574844777253315374","330387405518780465397403390363762478756","215890888295206688476670566225914578557","180800775238810118100131782244407644837"],"threshold":0.9},"id":"ASB-A-464526458-7cda60a8","signature_type":"Line"},{"deprecated":false,"digest":{"length":1402,"function_hash":"212149598703801142655170959717874680712"},"id":"ASB-A-464526458-c5f70e5f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java","function":"areBackgroundActivityStartsAllowed"}},{"id":"ASB-A-464526458-f794b764","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87","target":{"function":"BackgroundLaunchProcessController","file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false,"digest":{"function_hash":"314235660009376757178028004664370744928","length":152}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-464526458.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java","function":"BackgroundLaunchProcessController"},"deprecated":false,"digest":{"length":152,"function_hash":"314235660009376757178028004664370744928"},"id":"ASB-A-464526458-004d668c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false,"digest":{"line_hashes":["269919879288557531431549615596513720539","102857065816403933007667912064713155348","284864839436383791561624235069037153809","211660263292507573797006478975017090501","283708962198578721655982350975381204609","151246692116000714145758709506519188041","75764128462750765707573704157076991346","49209169815236049901648328848139260706","228649580167071546740086712885126606374","116817328366553531740104663848123646376","175762470153445334763409674220116161417","70263026317357662030265406059344814676","149936038488966642756316536744704199116","178498502371138113737600816739126287684","110422244730757250624945615794147314957","238280979789010909138282512357853600217","72876531201846381436074926870788598644","293250796321213382903584523752051680385","231912993505126684309873105459441858933","138958301752926086560920109173342050953","58838867726842286788809732133561429456"],"threshold":0.9},"id":"ASB-A-464526458-1d5fbe23"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5","target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java","function":"WindowProcessController"},"deprecated":false,"digest":{"length":674,"function_hash":"47341408136498732326287502129607834834"},"id":"ASB-A-464526458-48ed9745","signature_type":"Function","signature_version":"v1"},{"digest":{"length":1324,"function_hash":"143380978350973373013440701584546112244"},"id":"ASB-A-464526458-baf6c471","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5","target":{"function":"areBackgroundActivityStartsAllowed","file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["73046504618660582395574844777253315374","330387405518780465397403390363762478756","215890888295206688476670566225914578557","180800775238810118100131782244407644837"]},"id":"ASB-A-464526458-e9b8806e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5","target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5","target":{"function":"isBoundByForegroundUid","file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false,"digest":{"length":315,"function_hash":"197684456420924789431075614136860390978"},"id":"ASB-A-464526458-faa0f3de","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-464526458.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java","function":"areBackgroundActivityStartsAllowed"},"deprecated":false,"digest":{"function_hash":"72462734984194906042362744320471711572","length":1759},"id":"ASB-A-464526458-2678ef65","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["269919879288557531431549615596513720539","102857065816403933007667912064713155348","284864839436383791561624235069037153809","211660263292507573797006478975017090501","283708962198578721655982350975381204609","151246692116000714145758709506519188041","75764128462750765707573704157076991346","49209169815236049901648328848139260706","257653025265942308526684579097091622214","197613014809239923350346780103550900195","275861114373772380191480492836790634733","70939824290936514268685772562913864706","254690565360647050784500274569503610406","178498502371138113737600816739126287684","110422244730757250624945615794147314957","238280979789010909138282512357853600217","72876531201846381436074926870788598644","293250796321213382903584523752051680385","231912993505126684309873105459441858933","138958301752926086560920109173342050953","58838867726842286788809732133561429456"],"threshold":0.9},"id":"ASB-A-464526458-375da634","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70","target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"}},{"target":{"function":"BackgroundLaunchProcessController","file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false,"digest":{"length":152,"function_hash":"314235660009376757178028004664370744928"},"id":"ASB-A-464526458-54c729dc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70"},{"deprecated":false,"digest":{"line_hashes":["73046504618660582395574844777253315374","330387405518780465397403390363762478756","215890888295206688476670566225914578557","180800775238810118100131782244407644837"],"threshold":0.9},"id":"ASB-A-464526458-822b2dd1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70","target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"}},{"target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java","function":"WindowProcessController"},"deprecated":false,"digest":{"function_hash":"205441195860207224400870271790685422467","length":676},"id":"ASB-A-464526458-bfe10e92","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70","target":{"function":"isBoundByForegroundUid","file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"},"deprecated":false,"digest":{"function_hash":"197684456420924789431075614136860390978","length":315},"id":"ASB-A-464526458-ed060327","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-464526458.json"}}],"schema_version":"1.9.0"}