{"id":"ASB-A-493560718","details":"In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-493560718","CVE-2026-59006"],"modified":"2026-11-02T17:11:09.415385592Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/644d73a56d136376c052d641a72ed295a014be93","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["263822556441911165891610940040250278120","177267738852610555867912701756373077051","131896460693630934777011742160500440453","140523303107324688930089385689509889199","211497973712615322744943800371285433530","221947765243074306361954900453473477698","75482830770596955224240040682167349982","71553091076309277918679050981398537278"]},"id":"ASB-A-493560718-4a47acda","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/644d73a56d136376c052d641a72ed295a014be93","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"getTouchOcclusionMode"},"deprecated":false,"digest":{"length":290,"function_hash":"229051789775580557622293779305217738901"},"id":"ASB-A-493560718-aa9f9ee2","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/644d73a56d136376c052d641a72ed295a014be93"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493560718.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":303,"function_hash":"3277107837179955311992309284313673426"},"id":"ASB-A-493560718-4202bed3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e25bc4b51c0209373297ae7805326adbcbf1571b","target":{"function":"getTouchOcclusionMode","file":"services/core/java/com/android/server/wm/WindowState.java"}},{"target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["98602935517539189078796617947873650318","28857181906792336993849598156285526146","254415503114804009852746662553596089557","18796852929389105922886150743408272599","211497973712615322744943800371285433530","221947765243074306361954900453473477698","75482830770596955224240040682167349982","71553091076309277918679050981398537278"],"threshold":0.9},"id":"ASB-A-493560718-61c16442","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e25bc4b51c0209373297ae7805326adbcbf1571b"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e25bc4b51c0209373297ae7805326adbcbf1571b"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493560718.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["98602935517539189078796617947873650318","28857181906792336993849598156285526146","254415503114804009852746662553596089557","18796852929389105922886150743408272599","211497973712615322744943800371285433530","221947765243074306361954900453473477698","75482830770596955224240040682167349982","71553091076309277918679050981398537278"],"threshold":0.9},"id":"ASB-A-493560718-219f70dd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ce4bfb5202295eb3687249639c1b1f35f317dfd4"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ce4bfb5202295eb3687249639c1b1f35f317dfd4","target":{"function":"getTouchOcclusionMode","file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"function_hash":"3277107837179955311992309284313673426","length":303},"id":"ASB-A-493560718-6a3f21f0","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ce4bfb5202295eb3687249639c1b1f35f317dfd4"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493560718.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"digest":{"function_hash":"229051789775580557622293779305217738901","length":290},"id":"ASB-A-493560718-22b4fb77","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4eb2a5bf3e78feae10e96f914e9c5ffe7b5cba6f","target":{"function":"getTouchOcclusionMode","file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4eb2a5bf3e78feae10e96f914e9c5ffe7b5cba6f","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["263822556441911165891610940040250278120","177267738852610555867912701756373077051","131896460693630934777011742160500440453","140523303107324688930089385689509889199","211497973712615322744943800371285433530","221947765243074306361954900453473477698","75482830770596955224240040682167349982","71553091076309277918679050981398537278"]},"id":"ASB-A-493560718-95ba0743"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4eb2a5bf3e78feae10e96f914e9c5ffe7b5cba6f"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493560718.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/2faf32ade6283851a5a09039f5ae44eee1fc1a11","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"getTouchOcclusionMode"},"deprecated":false,"digest":{"length":290,"function_hash":"229051789775580557622293779305217738901"},"id":"ASB-A-493560718-d6021cfa","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/2faf32ade6283851a5a09039f5ae44eee1fc1a11","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["263822556441911165891610940040250278120","177267738852610555867912701756373077051","131896460693630934777011742160500440453","140523303107324688930089385689509889199","211497973712615322744943800371285433530","221947765243074306361954900453473477698","75482830770596955224240040682167349982","71553091076309277918679050981398537278"],"threshold":0.9},"id":"ASB-A-493560718-e9e0a80a","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2faf32ade6283851a5a09039f5ae44eee1fc1a11"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493560718.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-11-01","types":["ID"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["98602935517539189078796617947873650318","28857181906792336993849598156285526146","254415503114804009852746662553596089557","18796852929389105922886150743408272599","211497973712615322744943800371285433530","175940650529954200897150587758129775259","321831147182538784590087151719046518163","288224359035068267585245600189131304739"],"threshold":0.9},"id":"ASB-A-493560718-80677974","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d3081acfa1839dd272648b44ef4a49a6b1ca6e71"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/d3081acfa1839dd272648b44ef4a49a6b1ca6e71","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"getTouchOcclusionMode"},"deprecated":false,"digest":{"function_hash":"3277107837179955311992309284313673426","length":303},"id":"ASB-A-493560718-fcd04510","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d3081acfa1839dd272648b44ef4a49a6b1ca6e71"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493560718.json"}}],"schema_version":"1.9.2"}