{"id":"ASB-A-493714520","details":"In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-493714520","CVE-2026-28650"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["43059124052323866583417567636333074251","334659300207295117288970136873278313255","267049085029665571361173817413210894093","133579854157735057935224292295453503209","68084759512144536888960179930788167211","337418779167730009292259489668165392662"],"threshold":0.9},"id":"ASB-A-493714520-5eab47af","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/617b18b15e675266e52fd88b69506ad7d5f86778"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/617b18b15e675266e52fd88b69506ad7d5f86778","target":{"function":"setHiddenWhileSuspended","file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"length":329,"function_hash":"222249259106316358477476803341054415810"},"id":"ASB-A-493714520-f77880be","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/617b18b15e675266e52fd88b69506ad7d5f86778"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493714520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["43059124052323866583417567636333074251","334659300207295117288970136873278313255","267049085029665571361173817413210894093","133579854157735057935224292295453503209","68084759512144536888960179930788167211","337418779167730009292259489668165392662"],"threshold":0.9},"id":"ASB-A-493714520-8da3ab20","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/372c0fdbf48e9a7d40a93338fc37fd5a70a3892b","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/372c0fdbf48e9a7d40a93338fc37fd5a70a3892b","target":{"function":"setHiddenWhileSuspended","file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"function_hash":"222249259106316358477476803341054415810","length":329},"id":"ASB-A-493714520-bd92e9ec","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/372c0fdbf48e9a7d40a93338fc37fd5a70a3892b"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493714520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/ec19d18c4ca34691f7c6ceb24fada48d66d3f296","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["43059124052323866583417567636333074251","334659300207295117288970136873278313255","267049085029665571361173817413210894093","133579854157735057935224292295453503209","68084759512144536888960179930788167211","337418779167730009292259489668165392662"],"threshold":0.9},"id":"ASB-A-493714520-330dc914","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"222249259106316358477476803341054415810","length":329},"id":"ASB-A-493714520-3392678f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ec19d18c4ca34691f7c6ceb24fada48d66d3f296","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"setHiddenWhileSuspended"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ec19d18c4ca34691f7c6ceb24fada48d66d3f296"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493714520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-493714520-4eb28a7a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7061f4e08be7ffa9b98ea4b40dc5662677ca0d85","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["43059124052323866583417567636333074251","334659300207295117288970136873278313255","267049085029665571361173817413210894093","133579854157735057935224292295453503209","68084759512144536888960179930788167211","337418779167730009292259489668165392662"]}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7061f4e08be7ffa9b98ea4b40dc5662677ca0d85","target":{"function":"setHiddenWhileSuspended","file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"function_hash":"222249259106316358477476803341054415810","length":329},"id":"ASB-A-493714520-e46b073a","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7061f4e08be7ffa9b98ea4b40dc5662677ca0d85"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493714520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/767984f9160ccd92aa6dcc3fffdf6e8d94aaaff2"],"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-493714520-a9e34702","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/767984f9160ccd92aa6dcc3fffdf6e8d94aaaff2","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["43059124052323866583417567636333074251","334659300207295117288970136873278313255","267049085029665571361173817413210894093","133579854157735057935224292295453503209","68084759512144536888960179930788167211","337418779167730009292259489668165392662"]}},{"id":"ASB-A-493714520-d13439f8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/767984f9160ccd92aa6dcc3fffdf6e8d94aaaff2","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"setHiddenWhileSuspended"},"deprecated":false,"digest":{"length":329,"function_hash":"222249259106316358477476803341054415810"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493714520.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/005d5379546ba46422393874b5e08e71d26f4cfd","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["43059124052323866583417567636333074251","334659300207295117288970136873278313255","267049085029665571361173817413210894093","133579854157735057935224292295453503209","68084759512144536888960179930788167211","337418779167730009292259489668165392662"],"threshold":0.9},"id":"ASB-A-493714520-643b5c3b","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/005d5379546ba46422393874b5e08e71d26f4cfd","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"setHiddenWhileSuspended"},"deprecated":false,"digest":{"function_hash":"222249259106316358477476803341054415810","length":329},"id":"ASB-A-493714520-f024bab3","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/005d5379546ba46422393874b5e08e71d26f4cfd"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-493714520.json"}}],"schema_version":"1.9.0"}