In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/8853b2c7af09156a1e8666ddaa3bf97eff473665"
],
"spl": "2026-03-01",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8853b2c7af09156a1e8666ddaa3bf97eff473665",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-41698b42",
"digest": {
"threshold": 0.9,
"line_hashes": [
"110382215302634542645335066745615701512",
"26906535831794056007525168194150567418",
"144438774189455227929422869652895148082",
"232426068869992933412405171213938863767",
"75987645390306680308453132245418479368",
"783067177529830617860720821817272886",
"140321667198434520220409905801513018651",
"90182813401230354713723005426767411528",
"294701531416806876134016405849209667949",
"212017153395917813298974933024583790779",
"226675218255492127313899360081318620835",
"108581047267505810894129243150447420",
"89614258445909329895037724713881986781",
"234732244061619758372164634869983329343",
"52510844341207763312035489124989214829",
"195745007635142648375301938455426877034",
"293002793919716874651487387010250722468",
"15678081007258580063088564170011996690",
"291414437685968757096565280514633831931",
"155295401692532238037541025382320450325",
"339887477730865114162678811482016532688",
"227325821791169484702772360982505339746",
"202917564632775804357660950664868045512",
"131949335428092995063596337434555711990",
"200107506373731713536301571023728313319",
"177427134586438265366589543221060702736",
"161602685994031332907799192899047789526",
"3854639699640748511450119459395799878",
"140134192251946146354990305747517551131",
"332145991857691101172215031299601092751",
"58694051697045717642676246580565249815",
"100405973151361202907280650184757392932",
"322947046538466018856516155713142420382",
"306971231799734360450167537826640670929",
"29962371245981165654009855480226827822",
"152394008289674541045464234254073824534",
"33599298600990276912621369466537265061",
"48843882648341427532557079359626098855",
"137535391882829454192864931625649023753",
"290109475931813624275329990453805715739",
"82297045491975301610456907350080244158"
]
},
"signature_type": "Line",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8853b2c7af09156a1e8666ddaa3bf97eff473665",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-6ac3fc91",
"digest": {
"length": 1074.0,
"function_hash": "17603422643444010325110081051921938598"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "showSurfaceBehindKeyguard"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8853b2c7af09156a1e8666ddaa3bf97eff473665",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-8ef5a8b7",
"digest": {
"length": 5719.0,
"function_hash": "136389297246133671491872514591598365057"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleStartKeyguardExitAnimationInner"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8853b2c7af09156a1e8666ddaa3bf97eff473665",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-92211055",
"digest": {
"length": 323.0,
"function_hash": "87934629311454196538358134281739799395"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "showKeyguard"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8853b2c7af09156a1e8666ddaa3bf97eff473665",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-d6f7c19b",
"digest": {
"length": 1287.0,
"function_hash": "28863225248429349646227461405937025128"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleHide"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8853b2c7af09156a1e8666ddaa3bf97eff473665",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-d8231daf",
"digest": {
"length": 1494.0,
"function_hash": "135825944579064761769525328611665179478"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleShowInner"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/8853b2c7af09156a1e8666ddaa3bf97eff473665",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-efada17d",
"digest": {
"length": 1230.0,
"function_hash": "19668613670982375974146476211896737129"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "setKeyguardEnabled"
}
}
],
"severity": "High"
}
{
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3"
],
"spl": "2026-03-01",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-17cd0d0f",
"digest": {
"length": 1585.0,
"function_hash": "102929578416239442830889315237998207206"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "exitKeyguardAndFinishSurfaceBehindRemoteAnimation"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-23ce9c14",
"digest": {
"length": 875.0,
"function_hash": "248010336975784081649186636802439142919"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleCancelKeyguardExitAnimation"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-3efa2469",
"digest": {
"length": 1230.0,
"function_hash": "19668613670982375974146476211896737129"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "setKeyguardEnabled"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-74915a50",
"digest": {
"length": 805.0,
"function_hash": "127116610729583270268463469847072195407"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "showSurfaceBehindKeyguard"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-911984c8",
"digest": {
"length": 371.0,
"function_hash": "202190480341590054711734946805089684258"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "onAnimationFinished"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-a2185a97",
"digest": {
"length": 323.0,
"function_hash": "87934629311454196538358134281739799395"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "showKeyguard"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-b6246cfc",
"digest": {
"length": 1554.0,
"function_hash": "40199517844065522685689455438797473258"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleShow"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-cffe183a",
"digest": {
"length": 5344.0,
"function_hash": "23493679924832785185585838102917194991"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleStartKeyguardExitAnimation"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-d809eac9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"110382215302634542645335066745615701512",
"26906535831794056007525168194150567418",
"144438774189455227929422869652895148082",
"263362796172401618171816324307106061311",
"104210213150496869736262781794973691382",
"66311161022088914021884607801787065854",
"15036091686460624186897317190213836650",
"232426068869992933412405171213938863767",
"75987645390306680308453132245418479368",
"783067177529830617860720821817272886",
"140321667198434520220409905801513018651",
"90182813401230354713723005426767411528",
"294701531416806876134016405849209667949",
"212017153395917813298974933024583790779",
"226675218255492127313899360081318620835",
"108581047267505810894129243150447420",
"89614258445909329895037724713881986781",
"234732244061619758372164634869983329343",
"132779643176385879771565261177492326623",
"312043770450585310919216749214642078477",
"293002793919716874651487387010250722468",
"15678081007258580063088564170011996690",
"291414437685968757096565280514633831931",
"155295401692532238037541025382320450325",
"15697593931685474078191809189454885603",
"227325821791169484702772360982505339746",
"202917564632775804357660950664868045512",
"131949335428092995063596337434555711990",
"200107506373731713536301571023728313319",
"177427134586438265366589543221060702736",
"161602685994031332907799192899047789526",
"3854639699640748511450119459395799878",
"315471380625990368657110471072645058611",
"38421129179864536618738358778295645168",
"175190404982523593980469463486457970162",
"58028876174026346965516781206134385257",
"79513108598837032818635416363955535049",
"249612962298926180897523361080483795025",
"34252910469569846262237681985613705414",
"117597697965391752949154691628740393057",
"60672797852027609860638157643396834710",
"244266978843754212526564840124764091027",
"214205287303508680347248700207850110848",
"138205457823461144566019900420551465079",
"329767437367413600201033841053130493311",
"32642436917011385001071374117375643777",
"242133163761301675364206706775756684183",
"232002761479426018424034639095206844768",
"137535391882829454192864931625649023753",
"290109475931813624275329990453805715739",
"82297045491975301610456907350080244158"
]
},
"signature_type": "Line",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/31d93f9896ee0fde5f3ee82346c2a9d2f2069cd3",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-e81f617e",
"digest": {
"length": 1309.0,
"function_hash": "169523847608655234449514025839079598837"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleHide"
}
}
],
"severity": "High"
}
{
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/11324a5d9b5d8e17cee1002a41fb367ec85b4400"
],
"spl": "2026-03-01",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/11324a5d9b5d8e17cee1002a41fb367ec85b4400",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-189dec39",
"digest": {
"length": 5678.0,
"function_hash": "40262726469491774312392395857480333545"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleStartKeyguardExitAnimationInner"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/11324a5d9b5d8e17cee1002a41fb367ec85b4400",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-2f79412e",
"digest": {
"length": 1494.0,
"function_hash": "135825944579064761769525328611665179478"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleShowInner"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/11324a5d9b5d8e17cee1002a41fb367ec85b4400",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-43635945",
"digest": {
"length": 1230.0,
"function_hash": "19668613670982375974146476211896737129"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "setKeyguardEnabled"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/11324a5d9b5d8e17cee1002a41fb367ec85b4400",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-529739dd",
"digest": {
"length": 1074.0,
"function_hash": "17603422643444010325110081051921938598"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "showSurfaceBehindKeyguard"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/11324a5d9b5d8e17cee1002a41fb367ec85b4400",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-5ce5b689",
"digest": {
"length": 1287.0,
"function_hash": "28863225248429349646227461405937025128"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleHide"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/11324a5d9b5d8e17cee1002a41fb367ec85b4400",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-f6b947b7",
"digest": {
"length": 323.0,
"function_hash": "87934629311454196538358134281739799395"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "showKeyguard"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/11324a5d9b5d8e17cee1002a41fb367ec85b4400",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-fd820e51",
"digest": {
"threshold": 0.9,
"line_hashes": [
"110382215302634542645335066745615701512",
"26906535831794056007525168194150567418",
"144438774189455227929422869652895148082",
"232426068869992933412405171213938863767",
"75987645390306680308453132245418479368",
"783067177529830617860720821817272886",
"140321667198434520220409905801513018651",
"90182813401230354713723005426767411528",
"294701531416806876134016405849209667949",
"212017153395917813298974933024583790779",
"226675218255492127313899360081318620835",
"108581047267505810894129243150447420",
"89614258445909329895037724713881986781",
"234732244061619758372164634869983329343",
"52510844341207763312035489124989214829",
"195745007635142648375301938455426877034",
"293002793919716874651487387010250722468",
"15678081007258580063088564170011996690",
"291414437685968757096565280514633831931",
"155295401692532238037541025382320450325",
"339887477730865114162678811482016532688",
"227325821791169484702772360982505339746",
"202917564632775804357660950664868045512",
"131949335428092995063596337434555711990",
"200107506373731713536301571023728313319",
"177427134586438265366589543221060702736",
"161602685994031332907799192899047789526",
"3854639699640748511450119459395799878",
"140134192251946146354990305747517551131",
"332145991857691101172215031299601092751",
"58694051697045717642676246580565249815",
"100405973151361202907280650184757392932",
"322947046538466018856516155713142420382",
"306971231799734360450167537826640670929",
"29962371245981165654009855480226827822",
"152394008289674541045464234254073824534",
"33599298600990276912621369466537265061",
"48843882648341427532557079359626098855",
"137535391882829454192864931625649023753",
"290109475931813624275329990453805715739",
"82297045491975301610456907350080244158"
]
},
"signature_type": "Line",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
}
}
],
"severity": "High"
}
{
"types": [
"EoP"
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/dd1ab7030c89e4a7aa00e05a634cec7f6729e2e0"
],
"spl": "2026-03-01",
"vanir_signatures": [
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/dd1ab7030c89e4a7aa00e05a634cec7f6729e2e0",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-37c892ab",
"digest": {
"length": 1146.0,
"function_hash": "38122236905721145801627587421068127442"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleHide"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/dd1ab7030c89e4a7aa00e05a634cec7f6729e2e0",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-41e1f3a0",
"digest": {
"length": 319.0,
"function_hash": "154143727586980673032550871290146020335"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "showLocked"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/dd1ab7030c89e4a7aa00e05a634cec7f6729e2e0",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-4d5c3550",
"digest": {
"threshold": 0.9,
"line_hashes": [
"149374052923323886320469081832570557002",
"300356616098321855553924841719559210025",
"144438774189455227929422869652895148082",
"153080975068976777483130852342681367495",
"36222714938407532939907979523814756738",
"114151928686350800585249350415896740490",
"268277832603745568884716818937241416783",
"324416071847394645882215050825312059399",
"246078287455243205957096609475623888",
"212017153395917813298974933024583790779",
"226675218255492127313899360081318620835",
"108581047267505810894129243150447420",
"89614258445909329895037724713881986781",
"234732244061619758372164634869983329343",
"97612452526002849462114939792877626088",
"311590949911367054933114074716297891791",
"5225299649905024147476043738184144762",
"300639530838406076857057191362166920374",
"156585595142449762182704161234653400219",
"96007992132445805185252783087265739734",
"263598913391117418006858781030777056663",
"21838489572811540439316208331046908635",
"177445275899775155113715849502832870844",
"130734747023815346304048048636785096788",
"99451205731739445764898905374232505762",
"183910091936433708796462730176297734247",
"143089521601681381224542877908717854873",
"112167990107756261767413273807659880301",
"228755193470187580628474391594141179695",
"214934182447653554196887769756554874577",
"116269986373424784839848603838090075158",
"168414321231651417503037381063482768422",
"207660497458770694325724061003358827933",
"72899257963558547587083517737062326375",
"195716271812840796808563146607019565200",
"150235948965215317763325269064711966202",
"54472386673843997219214104424553772835",
"87511458077003704596131920688417096962"
]
},
"signature_type": "Line",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/dd1ab7030c89e4a7aa00e05a634cec7f6729e2e0",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-79f9935c",
"digest": {
"length": 4900.0,
"function_hash": "165921679023429251286507549895749213767"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleStartKeyguardExitAnimation"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/dd1ab7030c89e4a7aa00e05a634cec7f6729e2e0",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-88e53ccd",
"digest": {
"length": 1205.0,
"function_hash": "84483865632428453713612837864235112586"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "handleShow"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/dd1ab7030c89e4a7aa00e05a634cec7f6729e2e0",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-c08ad422",
"digest": {
"length": 1228.0,
"function_hash": "135906236961199672507836630124422429654"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "setKeyguardEnabled"
}
},
{
"source": "https://android.googlesource.com/platform/frameworks/base/+/dd1ab7030c89e4a7aa00e05a634cec7f6729e2e0",
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-395640609-e6ed8198",
"digest": {
"length": 687.0,
"function_hash": "250020968066990624253496753061784777616"
},
"signature_type": "Function",
"target": {
"file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
"function": "showSurfaceBehindKeyguard"
}
}
],
"severity": "High"
}