In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"types": [
"EoP"
],
"spl": "2026-06-01",
"vanir_signatures": [
{
"id": "ASB-A-467082881-40a423b7",
"target": {
"file": "services/core/java/com/android/server/wm/ActivityRecord.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"42416893407043339437710779091821531510",
"108750182971947963335630359034183535509",
"179292043823787497459463469323344968979",
"247109158301748321226384833186131981524"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/407d0fcb459d11b1574e1ebe6ccc297a9d00c6b6",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/407d0fcb459d11b1574e1ebe6ccc297a9d00c6b6"
],
"severity": "High"
}
{
"types": [
"EoP"
],
"spl": "2026-06-01",
"vanir_signatures": [
{
"id": "ASB-A-467082881-5b74c95f",
"target": {
"file": "services/core/java/com/android/server/wm/ActivityRecord.java"
},
"deprecated": false,
"digest": {
"line_hashes": [
"42416893407043339437710779091821531510",
"108750182971947963335630359034183535509",
"179292043823787497459463469323344968979",
"247109158301748321226384833186131981524"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/base/+/2e95632ce2f16f42a0b0d8c08ddffad49d952b44",
"signature_version": "v1"
}
],
"fixes": [
"https://android.googlesource.com/platform/frameworks/base/+/2e95632ce2f16f42a0b0d8c08ddffad49d952b44"
],
"severity": "High"
}