ASB-A-385347977

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-385347977.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-385347977
Aliases
  • A-385347977
  • CVE-2025-26433
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T16:56:24Z
Summary
[none]
Details

In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References

Affected packages

Android / platform/frameworks/native

Package

Name
platform/frameworks/native

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "27852702777802956446946993760532873183",
                "length":  3315
            },
            "id":  "ASB-A-385347977-14e6aa0f",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp",
                "function":  "LayerSnapshotBuilder::updateInput"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "178919437617283077774877895910859052582",
                    "111380456252735317263455197200840501304",
                    "11244053416831306091967487469587689593",
                    "6787638795401806036970479540044787961",
                    "157783538096809031353643904907226018034",
                    "23709466613914898636501949938533859201",
                    "27527102925150114586211728883052581960"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-4321dd33",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "140989369876152881276210062576714665341",
                "length":  404
            },
            "id":  "ASB-A-385347977-56979a93",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/RequestedLayerState.cpp",
                "function":  "RequestedLayerState::needsInputInfo"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "138377031501569344570071156268305874328",
                    "2287569253564120154783191341104865693",
                    "170518268625803685578692170059566066171",
                    "298886316803471864874505809069957904140"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-9a3d5ff7",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "187115584872065835124258339878705788931",
                    "114492998577407420746356399143929090242",
                    "175412779704010986705270160749183400609",
                    "26949142478832341270099466787117110"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-ae2a6b73",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/RequestedLayerState.h"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-385347977.json"

Android / platform/frameworks/native

Package

Name
platform/frameworks/native

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8",
        "https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "76645456001427929680655107424504868681",
                "length":  462
            },
            "id":  "ASB-A-385347977-0936ff76",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e",
            "target":  {
                "file":  "libs/gui/SurfaceControl.cpp",
                "function":  "SurfaceControl::generateSurfaceLocked"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "128135737400769776796077078207687502766",
                    "149933555301995305922491793489941606608",
                    "194558293354210483895911273661241305885",
                    "285302210163662062327481270086288574014"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-15a0f45f",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/RequestedLayerState.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "105220011585837361037938345749578822927",
                    "311945601997285600475698222514156653856",
                    "258870565328759151360944177947233954761",
                    "169129871573380618306370308952581941680"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-40d3af51",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "232550686492620791571962689886998322076",
                "length":  3267
            },
            "id":  "ASB-A-385347977-61f7df36",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp",
                "function":  "LayerSnapshotBuilder::updateInput"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "101602075548295543404928190931550875268",
                "length":  395
            },
            "id":  "ASB-A-385347977-aa8d583f",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp",
                "function":  "needsInputInfo"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "108898984718019726123183869764267605390",
                    "233123856869104002419687664905789284827",
                    "262621183142731668483114808080114521273",
                    "9567484725357046489592313641044482765",
                    "298886316803471864874505809069957904140"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-af99509b",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "255057014368123870940450721212444174840",
                    "53911117399724226795170942851915673910",
                    "94164455446402711450330084752025420066",
                    "306053644074581509350521785520225180331",
                    "80694592891549447935582136065173576100",
                    "213952627722867001596811538066895889477"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-baaea3db",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e",
            "target":  {
                "file":  "libs/gui/SurfaceControl.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "155044272526154480922187015190222489734",
                    "18002860625520027555481073588300294508",
                    "129223925621143283525818562399285453010",
                    "328146188331462701753940805816234795411",
                    "283035619929566102316203057203148959124",
                    "127495867647857042393310844605953761491",
                    "185147356067755367457988036883854598072",
                    "256675309401884478960626620304567475386",
                    "51953411527694178082713572231848516858",
                    "257722548820873051954479846885572745439",
                    "323892867020990830541419572875073874175",
                    "90459806601142480500197760816188983533",
                    "317274700460096653257852330161307790572",
                    "167707650307608612990449037329628749457",
                    "332486249985394067948336217829291010635",
                    "284302643563821127506568401640145723057",
                    "172452481224296751919078656886698200192",
                    "68696661544520616266860396676175702255",
                    "297772046054779024203931630979781582606",
                    "190656762347268792022937212539546582989",
                    "286439796831521652862346644373777956144"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-bcd7e77d",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "316561202100474119191796357055408884745",
                "length":  3609
            },
            "id":  "ASB-A-385347977-bda0bd13",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/RequestedLayerState.cpp",
                "function":  "RequestedLayerState::RequestedLayerState"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "314948560983223847531973593622176950972",
                "length":  3266
            },
            "id":  "ASB-A-385347977-c9204a58",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp",
                "function":  "LayerSnapshotBuilder::updateInput"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "157783538096809031353643904907226018034",
                    "23709466613914898636501949938533859201",
                    "27527102925150114586211728883052581960"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-ede5672e",
            "match_only_versions":  [
                "15"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8",
            "target":  {
                "file":  "services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-385347977.json"

Android / platform/frameworks/native

Package

Name
platform/frameworks/native

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/native/+/1cb7e56804a41c98c71ef6c80eb2e44f0b1ac49d",
        "https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "238525009910210859464347603952218061896",
                    "16976057652902572481340380646462930379",
                    "305715949065755907407256088028439688330",
                    "128202053576384182953996719204114133783"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-1f47c94a",
            "match_only_versions":  [
                "14"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/1cb7e56804a41c98c71ef6c80eb2e44f0b1ac49d",
            "target":  {
                "file":  "services/surfaceflinger/Layer.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "27936929993929874048716326856280822663",
                "length":  92
            },
            "id":  "ASB-A-385347977-37b20ed6",
            "match_only_versions":  [
                "14"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/1cb7e56804a41c98c71ef6c80eb2e44f0b1ac49d",
            "target":  {
                "file":  "services/surfaceflinger/Layer.h",
                "function":  "needsInputInfo"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "215710529749722061207344159036774039737",
                "length":  313
            },
            "id":  "ASB-A-385347977-37da4312",
            "match_only_versions":  [
                "14"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e",
            "target":  {
                "file":  "services/surfaceflinger/Layer.cpp",
                "function":  "Layer::setInputInfo"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "93683255474763354072849610301527133844",
                    "68114928085856032543212733903025427514",
                    "292651427328025016645012563244481190536",
                    "152170461307441087749580560470543607822",
                    "21854129723508503117681102296993850823",
                    "86661735225991697357452502539957603076",
                    "302125276945752472208804497344413458891",
                    "274941069939674782230662735421341614294",
                    "285974249813489313830360987010569833441",
                    "167637840218581818769479152679384229892",
                    "249157280252713861571118657571353857671"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-6ea29d1d",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e",
            "target":  {
                "file":  "services/surfaceflinger/Layer.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "87037403875122739289451646358262770844",
                    "323099327199382606268971549381274573943",
                    "160231120480841555251235532301425083989",
                    "149618833907063867181547771518633021012",
                    "24291380174787456921442931217888800450",
                    "205002071888333412311357636307298151624",
                    "40040684718506752338375500701912096594",
                    "16861210677265303421161563316125873201"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-385347977-8416a118",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e",
            "target":  {
                "file":  "services/surfaceflinger/Layer.cpp"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-385347977.json"