ASB-A-407562568

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-407562568.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-407562568
Aliases
Published
2026-03-01T00:00:00Z
Modified
2026-03-19T16:29:45.216287Z
Summary
[none]
Details

In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2-next:0
Fixed
16-qpr2-next:2026-03-01

Affected versions

Other
16-qpr2-next

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "spl": "2026-03-01",
    "vanir_signatures": [
        {
            "id": "ASB-A-407562568-0546cbc1",
            "digest": {
                "function_hash": "7241460862620257759575331613510376986",
                "length": 1970.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/f17b66e731224605373efc27c448a048e954d663",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
                "function": "exitKeyguardAndFinishSurfaceBehindRemoteAnimation"
            }
        },
        {
            "id": "ASB-A-407562568-093badda",
            "digest": {
                "function_hash": "76827682085317640492417770206007998428",
                "length": 546.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/f17b66e731224605373efc27c448a048e954d663",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
                "function": "handleBeforeUserSwitching"
            }
        },
        {
            "id": "ASB-A-407562568-10e573c1",
            "digest": {
                "line_hashes": [
                    "108429126860948357537274543292170389621",
                    "97176192631897229311949910799081444958",
                    "133922730344520755610645367754246289317",
                    "114879154713382065371256006955323396806",
                    "154094825821043253339205705733798451099",
                    "169147459359828308322444658509850973973",
                    "219755974374221093483019226378572380507",
                    "259274666468066158807969889505466383975",
                    "202740147098715820193064097421091552602",
                    "307460358067923216688974800852580669987",
                    "150366122099979199142224801296540136317",
                    "102135582599805007200173367378260684687",
                    "267674775161265945870605957624342611620",
                    "266863325856482698085568140327246592465",
                    "79779419802409802309418625976888431071",
                    "144354207111274148470565568025575986059",
                    "12768901931424124727858832759285464686",
                    "37317416069809022492428456236584243731",
                    "328045865568541517658622850358587721633",
                    "265575614308882596499545210037248309213",
                    "89447663408169956822217983253258168420",
                    "202911584075723628845947504839999604582",
                    "9395399231686158385945055329916975534",
                    "173175738813603516002466648869213777008",
                    "33498843567045373231576015999742593313"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/f17b66e731224605373efc27c448a048e954d663",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/f17b66e731224605373efc27c448a048e954d663"
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-407562568.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-03-01

Affected versions

Other
15

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "spl": "2026-03-01",
    "vanir_signatures": [
        {
            "id": "ASB-A-407562568-0f1b08ea",
            "digest": {
                "function_hash": "76827682085317640492417770206007998428",
                "length": 546.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/59a4e4f5fcdb40220a208519a8c992839a8d91e6",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
                "function": "handleBeforeUserSwitching"
            }
        },
        {
            "id": "ASB-A-407562568-42929eea",
            "digest": {
                "function_hash": "202069526229920072466500632854230787174",
                "length": 1771.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/59a4e4f5fcdb40220a208519a8c992839a8d91e6",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
                "function": "exitKeyguardAndFinishSurfaceBehindRemoteAnimation"
            }
        },
        {
            "id": "ASB-A-407562568-b42a10da",
            "digest": {
                "line_hashes": [
                    "108429126860948357537274543292170389621",
                    "97176192631897229311949910799081444958",
                    "133922730344520755610645367754246289317",
                    "114879154713382065371256006955323396806",
                    "154094825821043253339205705733798451099",
                    "169147459359828308322444658509850973973",
                    "219755974374221093483019226378572380507",
                    "259274666468066158807969889505466383975",
                    "202740147098715820193064097421091552602",
                    "2072541909723117479461697359535680470",
                    "272181877205357076225459928440872297651",
                    "265575614308882596499545210037248309213",
                    "89447663408169956822217983253258168420",
                    "156302638417916845155181859555551659114",
                    "265966947131601776221690869677159898981",
                    "308457404082208822368031778794602573555",
                    "313336724464504891254269937529122891786"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/59a4e4f5fcdb40220a208519a8c992839a8d91e6",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/59a4e4f5fcdb40220a208519a8c992839a8d91e6"
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-407562568.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-03-01

Affected versions

Other
16

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "spl": "2026-03-01",
    "vanir_signatures": [
        {
            "id": "ASB-A-407562568-37de7a3f",
            "digest": {
                "line_hashes": [
                    "108429126860948357537274543292170389621",
                    "97176192631897229311949910799081444958",
                    "133922730344520755610645367754246289317",
                    "114879154713382065371256006955323396806",
                    "154094825821043253339205705733798451099",
                    "169147459359828308322444658509850973973",
                    "219755974374221093483019226378572380507",
                    "259274666468066158807969889505466383975",
                    "202740147098715820193064097421091552602",
                    "307460358067923216688974800852580669987",
                    "150366122099979199142224801296540136317",
                    "102135582599805007200173367378260684687",
                    "267674775161265945870605957624342611620",
                    "266863325856482698085568140327246592465",
                    "79779419802409802309418625976888431071",
                    "242133163761301675364206706775756684183",
                    "232002761479426018424034639095206844768",
                    "2072541909723117479461697359535680470",
                    "272181877205357076225459928440872297651",
                    "265575614308882596499545210037248309213",
                    "89447663408169956822217983253258168420",
                    "202911584075723628845947504839999604582",
                    "9395399231686158385945055329916975534",
                    "173175738813603516002466648869213777008",
                    "33498843567045373231576015999742593313"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/08f1b10474f75ebf2b993d50993777e2853c111f",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            }
        },
        {
            "id": "ASB-A-407562568-97dda488",
            "digest": {
                "function_hash": "168360330606969228272650251753554428166",
                "length": 1888.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/08f1b10474f75ebf2b993d50993777e2853c111f",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
                "function": "exitKeyguardAndFinishSurfaceBehindRemoteAnimation"
            }
        },
        {
            "id": "ASB-A-407562568-9e4abdf7",
            "digest": {
                "function_hash": "76827682085317640492417770206007998428",
                "length": 546.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/08f1b10474f75ebf2b993d50993777e2853c111f",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
                "function": "handleBeforeUserSwitching"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/08f1b10474f75ebf2b993d50993777e2853c111f"
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-407562568.json"

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-03-01

Affected versions

Other
14

Ecosystem specific 

{
    "types": [
        "EoP"
    ],
    "spl": "2026-03-01",
    "vanir_signatures": [
        {
            "id": "ASB-A-407562568-32fdf838",
            "digest": {
                "function_hash": "231374567450861248473879829509237195216",
                "length": 1952.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/5adb31670830e04cff3b49960875a551c1cccf0a",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
                "function": "exitKeyguardAndFinishSurfaceBehindRemoteAnimation"
            }
        },
        {
            "id": "ASB-A-407562568-4b04f868",
            "digest": {
                "function_hash": "339586397106446965437520818177228255373",
                "length": 840.0
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/5adb31670830e04cff3b49960875a551c1cccf0a",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java",
                "function": "setCurrentUser"
            }
        },
        {
            "id": "ASB-A-407562568-89cbd6be",
            "digest": {
                "line_hashes": [
                    "288823486499361014941068198937159355062",
                    "98235460483039653230575453223622576192",
                    "235949370961387677963331199577261396069",
                    "328935888874184870080797008435197333251",
                    "219755974374221093483019226378572380507",
                    "282029752030146130827396068310248841110",
                    "98657249708548741115416671551839586249",
                    "2072541909723117479461697359535680470",
                    "30455455226514450866123763760318583332",
                    "47857763316653466470692776714439731087",
                    "52483816978728842971284946385920496178",
                    "135633798647508570043973424889067068778",
                    "266348545204935708119013781792281451209",
                    "86635289623547260719401884955686044695",
                    "156121418211532538057031191391559831315",
                    "8650746436425999016019617655219595270",
                    "156302638417916845155181859555551659114",
                    "265966947131601776221690869677159898981",
                    "308457404082208822368031778794602573555",
                    "313336724464504891254269937529122891786"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/5adb31670830e04cff3b49960875a551c1cccf0a",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/5adb31670830e04cff3b49960875a551c1cccf0a"
    ],
    "severity": "High"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-407562568.json"