ASB-A-438973280

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-438973280.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-438973280
Aliases
  • A-438973280
  • CVE-2025-48616
Published
2026-06-01T00:00:00Z
Modified
2026-06-08T15:01:31.246215948Z
Summary
[none]
Details

In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-06-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "types": [
        "ID"
    ],
    "spl": "2026-06-01",
    "severity": "High",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651",
            "id": "ASB-A-438973280-254fedbb",
            "digest": {
                "length": 2920.0,
                "function_hash": "62065052189309584053778982792654750880"
            },
            "target": {
                "function": "doKeyguardLocked",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651",
            "digest": {
                "length": 1312.0,
                "function_hash": "187740487069481619775985710964898753634"
            },
            "id": "ASB-A-438973280-5675988f",
            "target": {
                "function": "setKeyguardEnabled",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651",
            "digest": {
                "length": 205.0,
                "function_hash": "144717035925538850326922822744760286648"
            },
            "id": "ASB-A-438973280-5de8e2bd",
            "target": {
                "function": "onStrongAuthStateChanged",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651",
            "digest": {
                "line_hashes": [
                    "209003653409485814053874828966339831762",
                    "248157843896045004288509290425769454425",
                    "295819614806895111282634632024505080583",
                    "33054126993467952584247571675358090874",
                    "157308877314888095909473701707830601155",
                    "302452540552734798692213935741771649446",
                    "178207226253972502873616493127000158293",
                    "1163217655246275190591404310621043494",
                    "320063222130511664022688046149485038347",
                    "63286039853862214767875888942314506820",
                    "38851795789724782623423941453576972444",
                    "289951149868027652041402854077089503975"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-438973280-8d5adee9",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-06-01

Affected versions

Other
15

Ecosystem specific 

{
    "types": [
        "ID"
    ],
    "spl": "2026-06-01",
    "severity": "High",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10",
            "digest": {
                "length": 1312.0,
                "function_hash": "187740487069481619775985710964898753634"
            },
            "id": "ASB-A-438973280-1237e20a",
            "target": {
                "function": "setKeyguardEnabled",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10",
            "digest": {
                "length": 2458.0,
                "function_hash": "9534616859167290042442020910009650438"
            },
            "id": "ASB-A-438973280-3e50391a",
            "deprecated": false,
            "target": {
                "function": "doKeyguardLocked",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10",
            "digest": {
                "length": 137.0,
                "function_hash": "136313731282049621704943676923449853035"
            },
            "id": "ASB-A-438973280-7fbb6a41",
            "target": {
                "function": "onStrongAuthStateChanged",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10",
            "digest": {
                "line_hashes": [
                    "328443085910941181851152407178313554967",
                    "35067794694172749795438568066573731753",
                    "218896132632949222370235331652783459150",
                    "33054126993467952584247571675358090874",
                    "157308877314888095909473701707830601155",
                    "302452540552734798692213935741771649446",
                    "178207226253972502873616493127000158293",
                    "1163217655246275190591404310621043494",
                    "320063222130511664022688046149485038347",
                    "63286039853862214767875888942314506820",
                    "38851795789724782623423941453576972444",
                    "289951149868027652041402854077089503975"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-438973280-a39d99f7",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-06-01

Affected versions

Other
16

Ecosystem specific 

{
    "types": [
        "ID"
    ],
    "spl": "2026-06-01",
    "severity": "High",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905",
            "digest": {
                "length": 137.0,
                "function_hash": "136313731282049621704943676923449853035"
            },
            "id": "ASB-A-438973280-6b93965b",
            "target": {
                "function": "onStrongAuthStateChanged",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905",
            "digest": {
                "length": 1312.0,
                "function_hash": "187740487069481619775985710964898753634"
            },
            "id": "ASB-A-438973280-cbdb6460",
            "target": {
                "function": "setKeyguardEnabled",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905",
            "digest": {
                "line_hashes": [
                    "328443085910941181851152407178313554967",
                    "35067794694172749795438568066573731753",
                    "218896132632949222370235331652783459150",
                    "33054126993467952584247571675358090874",
                    "157308877314888095909473701707830601155",
                    "302452540552734798692213935741771649446",
                    "178207226253972502873616493127000158293",
                    "1163217655246275190591404310621043494",
                    "320063222130511664022688046149485038347",
                    "63286039853862214767875888942314506820",
                    "38851795789724782623423941453576972444",
                    "289951149868027652041402854077089503975"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-438973280-ed8aa31e",
            "deprecated": false,
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905",
            "digest": {
                "length": 2787.0,
                "function_hash": "19444794359538423208616869984122610262"
            },
            "id": "ASB-A-438973280-f05f514a",
            "target": {
                "function": "doKeyguardLocked",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-06-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "types": [
        "ID"
    ],
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26",
            "digest": {
                "length": 2920.0,
                "function_hash": "62065052189309584053778982792654750880"
            },
            "id": "ASB-A-438973280-250f3531",
            "target": {
                "function": "doKeyguardLocked",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26",
            "digest": {
                "line_hashes": [
                    "209003653409485814053874828966339831762",
                    "248157843896045004288509290425769454425",
                    "295819614806895111282634632024505080583",
                    "33054126993467952584247571675358090874",
                    "157308877314888095909473701707830601155",
                    "302452540552734798692213935741771649446",
                    "178207226253972502873616493127000158293",
                    "1163217655246275190591404310621043494",
                    "320063222130511664022688046149485038347",
                    "63286039853862214767875888942314506820",
                    "38851795789724782623423941453576972444",
                    "289951149868027652041402854077089503975"
                ],
                "threshold": 0.9
            },
            "id": "ASB-A-438973280-2d0a3a4b",
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26",
            "id": "ASB-A-438973280-7f0e9bc5",
            "digest": {
                "length": 1312.0,
                "function_hash": "187740487069481619775985710964898753634"
            },
            "target": {
                "function": "setKeyguardEnabled",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26",
            "digest": {
                "length": 205.0,
                "function_hash": "144717035925538850326922822744760286648"
            },
            "id": "ASB-A-438973280-8ffb71c3",
            "target": {
                "function": "onStrongAuthStateChanged",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        }
    ],
    "severity": "High",
    "spl": "2026-06-01",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-06-01

Affected versions

Other
14

Ecosystem specific 

{
    "types": [
        "ID"
    ],
    "spl": "2026-06-01",
    "severity": "High",
    "vanir_signatures": [
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc",
            "digest": {
                "length": 2452.0,
                "function_hash": "28355018146740837997510255390809824199"
            },
            "id": "ASB-A-438973280-0fe5ac68",
            "target": {
                "function": "doKeyguardLocked",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc",
            "digest": {
                "length": 1310.0,
                "function_hash": "74706416706882606468745504616270143627"
            },
            "id": "ASB-A-438973280-72be80c2",
            "target": {
                "function": "setKeyguardEnabled",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc",
            "id": "ASB-A-438973280-8e51eb3f",
            "digest": {
                "line_hashes": [
                    "38867570063675643553038483487100176832",
                    "163776543271928782038002134823982461851",
                    "199000920925165640654848569466156005191",
                    "215446848326935019446492765767272069821",
                    "32506973252840195140735957884626071389",
                    "12350634736937558266771328155721071284",
                    "199432919809092178067366540515146144839",
                    "280601339876405487838658475878899190765",
                    "220569421737926242352480083075105166400",
                    "315734703629131880403629904844485908198",
                    "223781247095430728760283417532866046923",
                    "190167032595858610910918531959616276798"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Line",
            "signature_version": "v1"
        },
        {
            "source": "https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc",
            "digest": {
                "length": 135.0,
                "function_hash": "286915552132051646324387458920861407957"
            },
            "id": "ASB-A-438973280-c391b580",
            "target": {
                "function": "onStrongAuthStateChanged",
                "file": "packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"
            },
            "deprecated": false,
            "signature_type": "Function",
            "signature_version": "v1"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc"
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-438973280.json"