ASB-A-376048041

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-376048041.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-376048041
Aliases
  • A-376048041
  • CVE-2025-48570
Published
2026-06-01T00:00:00Z
Modified
2026-06-12T15:08:17.296522730Z
Summary
[none]
Details

In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-06-01

Affected versions

Other
14

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "spl": "2026-06-01",
    "vanir_signatures": [
        {
            "signature_type": "Line",
            "target": {
                "file": "libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "269441865083221342326649577408145318077",
                    "156028149703521146675302373922355731176",
                    "225142177803471708763815187234494831067",
                    "86456216060200998801052865306828085812",
                    "284311963398253730348276618691952946244",
                    "276680722652991468837962084545001934614",
                    "236294929586587556930146569612945389373",
                    "87118459847215512901729674145684266933",
                    "24012896710107546920510062811017547571",
                    "284117436700839151443346954822213275980",
                    "142390309047380255238570596373879287290",
                    "28214925196935934081409457351289558849",
                    "107595101497419692725034617107836312544",
                    "113664377780682502555612390814443940370",
                    "154601613639577492178775769089451278614",
                    "37010348331977835696228704116407514139",
                    "333319740463213949623442906026781860136"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-376048041-1e5ec15e",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34",
            "signature_version": "v1"
        },
        {
            "signature_type": "Function",
            "target": {
                "file": "libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java",
                "function": "PipTaskOrganizer"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "146247374016712456008217424681411651440",
                "length": 1534.0
            },
            "id": "ASB-A-376048041-3879e528",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1",
            "signature_version": "v1"
        },
        {
            "id": "ASB-A-376048041-97389212",
            "target": {
                "file": "libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java",
                "function": "PipTaskOrganizer"
            },
            "deprecated": false,
            "signature_type": "Function",
            "digest": {
                "function_hash": "146247374016712456008217424681411651440",
                "length": 1534.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34",
            "signature_version": "v1"
        },
        {
            "id": "ASB-A-376048041-c3d4ea5d",
            "target": {
                "file": "libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java"
            },
            "deprecated": false,
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "269441865083221342326649577408145318077",
                    "156028149703521146675302373922355731176",
                    "225142177803471708763815187234494831067",
                    "86456216060200998801052865306828085812",
                    "284311963398253730348276618691952946244",
                    "276680722652991468837962084545001934614",
                    "236294929586587556930146569612945389373",
                    "87118459847215512901729674145684266933",
                    "24012896710107546920510062811017547571",
                    "284117436700839151443346954822213275980",
                    "142390309047380255238570596373879287290",
                    "28214925196935934081409457351289558849",
                    "107595101497419692725034617107836312544",
                    "113664377780682502555612390814443940370",
                    "154601613639577492178775769089451278614",
                    "37010348331977835696228704116407514139",
                    "333319740463213949623442906026781860136"
                ],
                "threshold": 0.9
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1",
            "signature_version": "v1"
        },
        {
            "id": "ASB-A-376048041-c9b2afa8",
            "target": {
                "file": "libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java",
                "function": "onTaskAppeared"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "199300417606562923587179034825898273583",
                "length": 3449.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/6b3066f8d199b17853992fc121f85bfa9aa43136",
            "signature_version": "v1"
        },
        {
            "id": "ASB-A-376048041-d4737e28",
            "target": {
                "file": "libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "180219592113640461097893359970873960623",
                    "195894146686590343361764087726600971076",
                    "30689948491166592403583923642656274044",
                    "276974954893670556217485962181940104166",
                    "30514597363130404269704632993379325419",
                    "87634651897060899545778323288807035198",
                    "181711378393630417383222112923096816112",
                    "311590496053789182717998329944433641066",
                    "194924281044677760179636975132016521909",
                    "310050125723998703389278272993684594203",
                    "74372822711773720336203741019167734284",
                    "52198168245931113607322411447672367691",
                    "114341721661609098826279358073033232412",
                    "101909345364621187262183070453044962243",
                    "193678400460692395289069624140453326533",
                    "43373005389999957244497533249623070270",
                    "58463539496980679591815254265170877759",
                    "335121423655335720842034799587906370202",
                    "224737870082030916607889451494456161382",
                    "210925256920358820371288855079134919106",
                    "247069501667618065590633464510913664539",
                    "308251549669097979824626467344850405310",
                    "214208758342627681801920162758297514389",
                    "326098138363640393073588723479544544849",
                    "290599586230745918191140170592184199158",
                    "233414161293627538116823167116836083340",
                    "97691685774373846913778784202380157086",
                    "226986306722274493215689753423878442163",
                    "217937712377750734768339320193208695424",
                    "308155636303884874614400196748616084018",
                    "187675970223052046877662680865087673850",
                    "45683765107764377968434683969471188540",
                    "245553796172791036065834118837644025654",
                    "172550656236282798206579420245136799228",
                    "23463598833202747865429744302755114321",
                    "325613873942686862235563969548867158901",
                    "170656104189663599275283758039336726805",
                    "164802573160246728527776408548487646988",
                    "161029281550041250738751561158801670194",
                    "131854211668154657969872869572948724471",
                    "48391509318112473858154044798423826240",
                    "256475901771657372804955980937893007878",
                    "249740194137442961801173305405632555421",
                    "6803814013952655354307906626023491935",
                    "6058704720784170960832128907614431951",
                    "23437065534193608067251769847222532940",
                    "258207890934716088662034845783348994518",
                    "291365812812237620006593258198261989675"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/6b3066f8d199b17853992fc121f85bfa9aa43136",
            "signature_version": "v1"
        },
        {
            "id": "ASB-A-376048041-e2961efe",
            "target": {
                "file": "libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java",
                "function": "onTaskAppeared"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "45977743421367724954429051316492832010",
                "length": 2712.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34",
            "signature_version": "v1"
        },
        {
            "id": "ASB-A-376048041-eefb8fdd",
            "target": {
                "file": "libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java",
                "function": "onTaskAppeared"
            },
            "deprecated": false,
            "digest": {
                "function_hash": "45977743421367724954429051316492832010",
                "length": 2712.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1",
            "signature_version": "v1"
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1",
        "https://android.googlesource.com/platform/frameworks/base/+/6b3066f8d199b17853992fc121f85bfa9aa43136",
        "https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-376048041.json"