{"id":"ASB-A-527038637","details":"In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-527038637","CVE-2026-58934"],"modified":"2026-11-02T16:56:14.598300382Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/adc9ad6a28520b2e48d9bb8f886cc7eb602485ec","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"prepareWindowToDisplayDuringRelayout"},"deprecated":false,"digest":{"function_hash":"111583122706557595446516432267511747009","length":1266},"id":"ASB-A-527038637-3b9ee4b3","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["172316532480260566771316135480817064860","229943414542373682695838821745334649417","290428625613526792657451817326184781708","324620822996435013849191408013256154006"]},"id":"ASB-A-527038637-7b0c2d27","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/adc9ad6a28520b2e48d9bb8f886cc7eb602485ec","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/adc9ad6a28520b2e48d9bb8f886cc7eb602485ec"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527038637.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0d805b6d75ae461f14fb2c2fdf2a2f226b3749f8","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"prepareWindowToDisplayDuringRelayout"},"deprecated":false,"digest":{"function_hash":"262135068018698350543515490589013414421","length":1238},"id":"ASB-A-527038637-4a4a7f5b"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0d805b6d75ae461f14fb2c2fdf2a2f226b3749f8","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["172316532480260566771316135480817064860","229943414542373682695838821745334649417","290428625613526792657451817326184781708","199946545686417349082869790978587771905"],"threshold":0.9},"id":"ASB-A-527038637-75932bb2"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0d805b6d75ae461f14fb2c2fdf2a2f226b3749f8"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527038637.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/416bf6c4e4abfa9c3c606c6aa33c4844443e97aa","target":{"function":"prepareWindowToDisplayDuringRelayout","file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"function_hash":"111583122706557595446516432267511747009","length":1266},"id":"ASB-A-527038637-981f6c18","signature_type":"Function"},{"target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["172316532480260566771316135480817064860","229943414542373682695838821745334649417","290428625613526792657451817326184781708","324620822996435013849191408013256154006"],"threshold":0.9},"id":"ASB-A-527038637-e3bbe6f3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/416bf6c4e4abfa9c3c606c6aa33c4844443e97aa"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/416bf6c4e4abfa9c3c606c6aa33c4844443e97aa"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527038637.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b852566e1601428469e1def048569f8934fb97d8"],"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/b852566e1601428469e1def048569f8934fb97d8","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["172316532480260566771316135480817064860","229943414542373682695838821745334649417","290428625613526792657451817326184781708","324620822996435013849191408013256154006"]},"id":"ASB-A-527038637-11b1d51c","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"111583122706557595446516432267511747009","length":1266},"id":"ASB-A-527038637-42403088","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b852566e1601428469e1def048569f8934fb97d8","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"prepareWindowToDisplayDuringRelayout"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527038637.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-527038637-0a387799","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cbe4bd259f21360d97331846e00ef2b9d3049953","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["172316532480260566771316135480817064860","229943414542373682695838821745334649417","290428625613526792657451817326184781708","324620822996435013849191408013256154006"],"threshold":0.9}},{"digest":{"function_hash":"111583122706557595446516432267511747009","length":1266},"id":"ASB-A-527038637-2cfb69e3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cbe4bd259f21360d97331846e00ef2b9d3049953","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"prepareWindowToDisplayDuringRelayout"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cbe4bd259f21360d97331846e00ef2b9d3049953"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527038637.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b069a8fc7b38e646598a31f75228172b6463f0a1","target":{"file":"services/core/java/com/android/server/wm/WindowState.java"},"deprecated":false,"digest":{"line_hashes":["172316532480260566771316135480817064860","229943414542373682695838821745334649417","290428625613526792657451817326184781708","236434643719041100710621819007992052237"],"threshold":0.9},"id":"ASB-A-527038637-0e67786e"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/b069a8fc7b38e646598a31f75228172b6463f0a1","target":{"file":"services/core/java/com/android/server/wm/WindowState.java","function":"prepareWindowToDisplayDuringRelayout"},"deprecated":false,"digest":{"length":1226,"function_hash":"128636909567675826003388939581272502992"},"id":"ASB-A-527038637-d130c7b5","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b069a8fc7b38e646598a31f75228172b6463f0a1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-527038637.json"}}],"schema_version":"1.9.2"}