{"id":"ASB-A-527035500","details":"In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-527035500","CVE-2026-58886"],"modified":"2026-11-02T17:11:16.718688300Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"},"deprecated":false,"digest":{"line_hashes":["155796206884827581862290594705919952658","258376708425011540055784706506003999557","190463034497598129357766158062266265273","22337772173762286085833662387581230965","190189954155783960380060441543380672617","332642691688574217111063064427631775610","121283967486499349383677047753904849475","303221094357557600421929831122170490966","301896271490353770296190580674027387579","37401843178170364963321369118708025702","142055367928194779100611511472078757114","1230587935592434539656609165700564261","15123631972920053487156663525640308556","98703169714776422973753199938184122318","63680734119120047066360396110246234345","149201177999688568953790755275430478634","319286328522927019737868094328041970199","193027717932953653290304402387503672635","39851372060237890451892885445288139122","302228880997054128390934844952167022378","19337811763439585549291717282855770916","248403770536023356145853180184457508943","186165088315825507913991499019514171327","204227658261051614813094647512083919101","270335475701597709356600968192283707928","41455009785870283809491221383365354832","169293239471054143244352914876719839193","209715496126177217885166689802031448886","124776521846284429917844913909419589065"],"threshold":0.9},"id":"ASB-A-527035500-46199987","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"accept"},"deprecated":false,"digest":{"length":1559,"function_hash":"187651833792784998513636090874008109862"},"id":"ASB-A-527035500-7c9fb830"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"updateInputWindows"},"deprecated":false,"digest":{"length":1339,"function_hash":"144882206472780664119034154537535057841"},"id":"ASB-A-527035500-e5f39fb4","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"accept"},"deprecated":false,"digest":{"length":2099,"function_hash":"22451502225606759144343886265447794085"},"id":"ASB-A-527035500-a3dd6440"},{"id":"ASB-A-527035500-d8da8270","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"},"deprecated":false,"digest":{"line_hashes":["155796206884827581862290594705919952658","258376708425011540055784706506003999557","190463034497598129357766158062266265273","22337772173762286085833662387581230965","190189954155783960380060441543380672617","332642691688574217111063064427631775610","121283967486499349383677047753904849475","303221094357557600421929831122170490966","301896271490353770296190580674027387579","37401843178170364963321369118708025702","142055367928194779100611511472078757114","1230587935592434539656609165700564261","124553947969102158064592103505137299749","301272396204600008384223290607903337996","63680734119120047066360396110246234345","149201177999688568953790755275430478634","319286328522927019737868094328041970199","193027717932953653290304402387503672635","39851372060237890451892885445288139122","302228880997054128390934844952167022378","19337811763439585549291717282855770916","248403770536023356145853180184457508943","186165088315825507913991499019514171327","204227658261051614813094647512083919101","270335475701597709356600968192283707928","41455009785870283809491221383365354832","169293239471054143244352914876719839193","209715496126177217885166689802031448886","124776521846284429917844913909419589065"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"updateInputWindows"},"deprecated":false,"digest":{"function_hash":"219480815561105820345550148068414694461","length":1425},"id":"ASB-A-527035500-d900547f"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"},"deprecated":false,"digest":{"line_hashes":["155796206884827581862290594705919952658","258376708425011540055784706506003999557","190463034497598129357766158062266265273","22337772173762286085833662387581230965","190189954155783960380060441543380672617","332642691688574217111063064427631775610","121283967486499349383677047753904849475","303221094357557600421929831122170490966","301896271490353770296190580674027387579","37401843178170364963321369118708025702","142055367928194779100611511472078757114","1230587935592434539656609165700564261","15123631972920053487156663525640308556","98703169714776422973753199938184122318","63680734119120047066360396110246234345","149201177999688568953790755275430478634","319286328522927019737868094328041970199","193027717932953653290304402387503672635","39851372060237890451892885445288139122","302228880997054128390934844952167022378","19337811763439585549291717282855770916","248403770536023356145853180184457508943","186165088315825507913991499019514171327","204227658261051614813094647512083919101","270335475701597709356600968192283707928","41455009785870283809491221383365354832","169293239471054143244352914876719839193","209715496126177217885166689802031448886","124776521846284429917844913909419589065"],"threshold":0.9},"id":"ASB-A-527035500-29fe63f9","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-527035500-ae7b61c6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"updateInputWindows"},"deprecated":false,"digest":{"length":1339,"function_hash":"144882206472780664119034154537535057841"}},{"deprecated":false,"digest":{"function_hash":"248183603591817373701342695682002415017","length":1534},"id":"ASB-A-527035500-c454b36f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"accept"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"accept"},"deprecated":false,"digest":{"function_hash":"248183603591817373701342695682002415017","length":1534},"id":"ASB-A-527035500-08276dde","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["155796206884827581862290594705919952658","258376708425011540055784706506003999557","190463034497598129357766158062266265273","22337772173762286085833662387581230965","190189954155783960380060441543380672617","332642691688574217111063064427631775610","121283967486499349383677047753904849475","303221094357557600421929831122170490966","301896271490353770296190580674027387579","37401843178170364963321369118708025702","142055367928194779100611511472078757114","1230587935592434539656609165700564261","15123631972920053487156663525640308556","98703169714776422973753199938184122318","63680734119120047066360396110246234345","149201177999688568953790755275430478634","319286328522927019737868094328041970199","193027717932953653290304402387503672635","39851372060237890451892885445288139122","302228880997054128390934844952167022378","19337811763439585549291717282855770916","248403770536023356145853180184457508943","186165088315825507913991499019514171327","204227658261051614813094647512083919101","270335475701597709356600968192283707928","41455009785870283809491221383365354832","169293239471054143244352914876719839193","209715496126177217885166689802031448886","124776521846284429917844913909419589065"]},"id":"ASB-A-527035500-66fbfb94","signature_type":"Line"},{"target":{"function":"updateInputWindows","file":"services/core/java/com/android/server/wm/InputMonitor.java"},"deprecated":false,"digest":{"length":1339,"function_hash":"144882206472780664119034154537535057841"},"id":"ASB-A-527035500-7d32301f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["155796206884827581862290594705919952658","258376708425011540055784706506003999557","190463034497598129357766158062266265273","22337772173762286085833662387581230965","190189954155783960380060441543380672617","332642691688574217111063064427631775610","121283967486499349383677047753904849475","303221094357557600421929831122170490966","301896271490353770296190580674027387579","37401843178170364963321369118708025702","142055367928194779100611511472078757114","1230587935592434539656609165700564261","15123631972920053487156663525640308556","98703169714776422973753199938184122318","63680734119120047066360396110246234345","149201177999688568953790755275430478634","319286328522927019737868094328041970199","193027717932953653290304402387503672635","39851372060237890451892885445288139122","302228880997054128390934844952167022378","19337811763439585549291717282855770916","248403770536023356145853180184457508943","186165088315825507913991499019514171327","204227658261051614813094647512083919101","270335475701597709356600968192283707928","41455009785870283809491221383365354832","169293239471054143244352914876719839193","209715496126177217885166689802031448886","124776521846284429917844913909419589065"],"threshold":0.9},"id":"ASB-A-527035500-086cb4fc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"}},{"target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"updateInputWindows"},"deprecated":false,"digest":{"length":1339,"function_hash":"144882206472780664119034154537535057841"},"id":"ASB-A-527035500-22a30625","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0"},{"target":{"function":"accept","file":"services/core/java/com/android/server/wm/InputMonitor.java"},"deprecated":false,"digest":{"length":1534,"function_hash":"248183603591817373701342695682002415017"},"id":"ASB-A-527035500-9f4a1d8f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"},"deprecated":false,"digest":{"line_hashes":["155796206884827581862290594705919952658","258376708425011540055784706506003999557","190463034497598129357766158062266265273","22337772173762286085833662387581230965","190189954155783960380060441543380672617","332642691688574217111063064427631775610","121283967486499349383677047753904849475","303221094357557600421929831122170490966","301896271490353770296190580674027387579","37401843178170364963321369118708025702","142055367928194779100611511472078757114","1230587935592434539656609165700564261","124553947969102158064592103505137299749","301272396204600008384223290607903337996","63680734119120047066360396110246234345","149201177999688568953790755275430478634","319286328522927019737868094328041970199","193027717932953653290304402387503672635","39851372060237890451892885445288139122","302228880997054128390934844952167022378","19337811763439585549291717282855770916","248403770536023356145853180184457508943","186165088315825507913991499019514171327","204227658261051614813094647512083919101","270335475701597709356600968192283707928","41455009785870283809491221383365354832","169293239471054143244352914876719839193","209715496126177217885166689802031448886","124776521846284429917844913909419589065"],"threshold":0.9},"id":"ASB-A-527035500-15a4f161","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"accept"},"deprecated":false,"digest":{"function_hash":"22451502225606759144343886265447794085","length":2099},"id":"ASB-A-527035500-71bd43b7"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d","target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java","function":"updateInputWindows"},"deprecated":false,"digest":{"function_hash":"219480815561105820345550148068414694461","length":1425},"id":"ASB-A-527035500-c4d67568","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"}}],"schema_version":"1.9.2"}