In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"73046504618660582395574844777253315374",
"330387405518780465397403390363762478756",
"215890888295206688476670566225914578557",
"180800775238810118100131782244407644837"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-0b7141e4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "143380978350973373013440701584546112244",
"length": 1324
},
"id": "ASB-A-464526458-2cfca4f6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "areBackgroundActivityStartsAllowed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"146769040500021787528545105549259973868",
"182325258103073499909270517816673883219",
"284864839436383791561624235069037153809",
"211660263292507573797006478975017090501",
"283708962198578721655982350975381204609",
"151246692116000714145758709506519188041",
"75764128462750765707573704157076991346",
"49209169815236049901648328848139260706",
"228649580167071546740086712885126606374",
"116817328366553531740104663848123646376",
"175762470153445334763409674220116161417",
"70263026317357662030265406059344814676",
"149936038488966642756316536744704199116",
"178498502371138113737600816739126287684",
"110422244730757250624945615794147314957",
"238280979789010909138282512357853600217",
"72876531201846381436074926870788598644",
"293250796321213382903584523752051680385",
"231912993505126684309873105459441858933",
"138958301752926086560920109173342050953",
"58838867726842286788809732133561429456"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-981fbdad",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "47341408136498732326287502129607834834",
"length": 674
},
"id": "ASB-A-464526458-a4284d5d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java",
"function": "WindowProcessController"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "197684456420924789431075614136860390978",
"length": 315
},
"id": "ASB-A-464526458-ace83611",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "isBoundByForegroundUid"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314235660009376757178028004664370744928",
"length": 152
},
"id": "ASB-A-464526458-f4a2a9fd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "BackgroundLaunchProcessController"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195",
"https://android.googlesource.com/platform/frameworks/base/+/66e70ef81382ada56496c7bc4225eb4a5e84e248"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"99162038471083773699272782685744667264",
"80205655137540829656108104452242663589",
"314235919336652542099470259239881947604",
"326415240541677075291145333357835595569",
"269919879288557531431549615596513720539",
"102857065816403933007667912064713155348",
"284864839436383791561624235069037153809",
"211660263292507573797006478975017090501",
"283708962198578721655982350975381204609",
"151246692116000714145758709506519188041",
"75764128462750765707573704157076991346",
"49209169815236049901648328848139260706",
"105883670696038004159354055967862803339",
"255984591127679450019907135772877356305",
"58866903693935143842157161898770863212",
"257277103302453843338359185206915243115",
"248545751631401845904730627242372349412",
"9047606762293242906155535157480681504",
"264194205621035045373163381903991372408",
"142117258438042846578136794806834282324",
"98223113605773475332000554373383288748",
"178498502371138113737600816739126287684",
"110422244730757250624945615794147314957",
"238280979789010909138282512357853600217",
"72876531201846381436074926870788598644",
"293250796321213382903584523752051680385",
"231912993505126684309873105459441858933",
"138958301752926086560920109173342050953",
"58838867726842286788809732133561429456"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-274ec9e4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "197684456420924789431075614136860390978",
"length": 315
},
"id": "ASB-A-464526458-33be2fa7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "isBoundByForegroundUid"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "254180117488952461526885384663677660079",
"length": 795
},
"id": "ASB-A-464526458-5d723dbd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java",
"function": "WindowProcessController"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "127515804240571674148418957220075186992",
"length": 1388
},
"id": "ASB-A-464526458-86a80a9e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "areBackgroundActivityStartsAllowed"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314235660009376757178028004664370744928",
"length": 152
},
"id": "ASB-A-464526458-940cb9e0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "BackgroundLaunchProcessController"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"73046504618660582395574844777253315374",
"330387405518780465397403390363762478756",
"215890888295206688476670566225914578557",
"180800775238810118100131782244407644837"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-a7e97c5c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87",
"https://android.googlesource.com/platform/frameworks/base/+/e26dda735b99edd974444462ce5b333dbbd3aa6a"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "197684456420924789431075614136860390978",
"length": 315
},
"id": "ASB-A-464526458-0dd0400d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "isBoundByForegroundUid"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "47341408136498732326287502129607834834",
"length": 674
},
"id": "ASB-A-464526458-6573dc35",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java",
"function": "WindowProcessController"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"269919879288557531431549615596513720539",
"102857065816403933007667912064713155348",
"284864839436383791561624235069037153809",
"211660263292507573797006478975017090501",
"283708962198578721655982350975381204609",
"151246692116000714145758709506519188041",
"75764128462750765707573704157076991346",
"49209169815236049901648328848139260706",
"228649580167071546740086712885126606374",
"116817328366553531740104663848123646376",
"122376956380815320468047852860214196351",
"234894974799769630399468878050193128926",
"160058135940036580118892726299854706698",
"178498502371138113737600816739126287684",
"110422244730757250624945615794147314957",
"238280979789010909138282512357853600217",
"72876531201846381436074926870788598644",
"293250796321213382903584523752051680385",
"231912993505126684309873105459441858933",
"138958301752926086560920109173342050953",
"58838867726842286788809732133561429456"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-672743d1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"73046504618660582395574844777253315374",
"330387405518780465397403390363762478756",
"215890888295206688476670566225914578557",
"180800775238810118100131782244407644837"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-7cda60a8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "212149598703801142655170959717874680712",
"length": 1402
},
"id": "ASB-A-464526458-c5f70e5f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "areBackgroundActivityStartsAllowed"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314235660009376757178028004664370744928",
"length": 152
},
"id": "ASB-A-464526458-f794b764",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "BackgroundLaunchProcessController"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "314235660009376757178028004664370744928",
"length": 152
},
"id": "ASB-A-464526458-004d668c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "BackgroundLaunchProcessController"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"269919879288557531431549615596513720539",
"102857065816403933007667912064713155348",
"284864839436383791561624235069037153809",
"211660263292507573797006478975017090501",
"283708962198578721655982350975381204609",
"151246692116000714145758709506519188041",
"75764128462750765707573704157076991346",
"49209169815236049901648328848139260706",
"228649580167071546740086712885126606374",
"116817328366553531740104663848123646376",
"175762470153445334763409674220116161417",
"70263026317357662030265406059344814676",
"149936038488966642756316536744704199116",
"178498502371138113737600816739126287684",
"110422244730757250624945615794147314957",
"238280979789010909138282512357853600217",
"72876531201846381436074926870788598644",
"293250796321213382903584523752051680385",
"231912993505126684309873105459441858933",
"138958301752926086560920109173342050953",
"58838867726842286788809732133561429456"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-1d5fbe23",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "47341408136498732326287502129607834834",
"length": 674
},
"id": "ASB-A-464526458-48ed9745",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java",
"function": "WindowProcessController"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "143380978350973373013440701584546112244",
"length": 1324
},
"id": "ASB-A-464526458-baf6c471",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "areBackgroundActivityStartsAllowed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"73046504618660582395574844777253315374",
"330387405518780465397403390363762478756",
"215890888295206688476670566225914578557",
"180800775238810118100131782244407644837"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-e9b8806e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "197684456420924789431075614136860390978",
"length": 315
},
"id": "ASB-A-464526458-faa0f3de",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "isBoundByForegroundUid"
}
}
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70"
],
"severity": "High",
"spl": "2026-09-01",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "72462734984194906042362744320471711572",
"length": 1759
},
"id": "ASB-A-464526458-2678ef65",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "areBackgroundActivityStartsAllowed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"269919879288557531431549615596513720539",
"102857065816403933007667912064713155348",
"284864839436383791561624235069037153809",
"211660263292507573797006478975017090501",
"283708962198578721655982350975381204609",
"151246692116000714145758709506519188041",
"75764128462750765707573704157076991346",
"49209169815236049901648328848139260706",
"257653025265942308526684579097091622214",
"197613014809239923350346780103550900195",
"275861114373772380191480492836790634733",
"70939824290936514268685772562913864706",
"254690565360647050784500274569503610406",
"178498502371138113737600816739126287684",
"110422244730757250624945615794147314957",
"238280979789010909138282512357853600217",
"72876531201846381436074926870788598644",
"293250796321213382903584523752051680385",
"231912993505126684309873105459441858933",
"138958301752926086560920109173342050953",
"58838867726842286788809732133561429456"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-375da634",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314235660009376757178028004664370744928",
"length": 152
},
"id": "ASB-A-464526458-54c729dc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "BackgroundLaunchProcessController"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"73046504618660582395574844777253315374",
"330387405518780465397403390363762478756",
"215890888295206688476670566225914578557",
"180800775238810118100131782244407644837"
],
"threshold": 0.9
},
"id": "ASB-A-464526458-822b2dd1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "205441195860207224400870271790685422467",
"length": 676
},
"id": "ASB-A-464526458-bfe10e92",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70",
"target": {
"file": "services/core/java/com/android/server/wm/WindowProcessController.java",
"function": "WindowProcessController"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "197684456420924789431075614136860390978",
"length": 315
},
"id": "ASB-A-464526458-ed060327",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70",
"target": {
"file": "services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java",
"function": "isBoundByForegroundUid"
}
}
]
}