ASB-A-527035500

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-527035500.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-527035500
Aliases
  • A-527035500
  • CVE-2026-58886
Published
2026-11-01T00:00:00Z
Modified
2026-11-02T17:11:16Z
Summary
[none]
Details

In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References

Affected packages

Android
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-qpr2-next:0
Fixed
17-qpr2-next:2026-11-01

Affected versions

Other
17-qpr2-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "155796206884827581862290594705919952658",
                    "258376708425011540055784706506003999557",
                    "190463034497598129357766158062266265273",
                    "22337772173762286085833662387581230965",
                    "190189954155783960380060441543380672617",
                    "332642691688574217111063064427631775610",
                    "121283967486499349383677047753904849475",
                    "303221094357557600421929831122170490966",
                    "301896271490353770296190580674027387579",
                    "37401843178170364963321369118708025702",
                    "142055367928194779100611511472078757114",
                    "1230587935592434539656609165700564261",
                    "15123631972920053487156663525640308556",
                    "98703169714776422973753199938184122318",
                    "63680734119120047066360396110246234345",
                    "149201177999688568953790755275430478634",
                    "319286328522927019737868094328041970199",
                    "193027717932953653290304402387503672635",
                    "39851372060237890451892885445288139122",
                    "302228880997054128390934844952167022378",
                    "19337811763439585549291717282855770916",
                    "248403770536023356145853180184457508943",
                    "186165088315825507913991499019514171327",
                    "204227658261051614813094647512083919101",
                    "270335475701597709356600968192283707928",
                    "41455009785870283809491221383365354832",
                    "169293239471054143244352914876719839193",
                    "209715496126177217885166689802031448886",
                    "124776521846284429917844913909419589065"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527035500-46199987",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "187651833792784998513636090874008109862",
                "length":  1559
            },
            "id":  "ASB-A-527035500-7c9fb830",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "accept"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "144882206472780664119034154537535057841",
                "length":  1339
            },
            "id":  "ASB-A-527035500-e5f39fb4",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "updateInputWindows"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-11-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "22451502225606759144343886265447794085",
                "length":  2099
            },
            "id":  "ASB-A-527035500-a3dd6440",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "accept"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "155796206884827581862290594705919952658",
                    "258376708425011540055784706506003999557",
                    "190463034497598129357766158062266265273",
                    "22337772173762286085833662387581230965",
                    "190189954155783960380060441543380672617",
                    "332642691688574217111063064427631775610",
                    "121283967486499349383677047753904849475",
                    "303221094357557600421929831122170490966",
                    "301896271490353770296190580674027387579",
                    "37401843178170364963321369118708025702",
                    "142055367928194779100611511472078757114",
                    "1230587935592434539656609165700564261",
                    "124553947969102158064592103505137299749",
                    "301272396204600008384223290607903337996",
                    "63680734119120047066360396110246234345",
                    "149201177999688568953790755275430478634",
                    "319286328522927019737868094328041970199",
                    "193027717932953653290304402387503672635",
                    "39851372060237890451892885445288139122",
                    "302228880997054128390934844952167022378",
                    "19337811763439585549291717282855770916",
                    "248403770536023356145853180184457508943",
                    "186165088315825507913991499019514171327",
                    "204227658261051614813094647512083919101",
                    "270335475701597709356600968192283707928",
                    "41455009785870283809491221383365354832",
                    "169293239471054143244352914876719839193",
                    "209715496126177217885166689802031448886",
                    "124776521846284429917844913909419589065"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527035500-d8da8270",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "219480815561105820345550148068414694461",
                "length":  1425
            },
            "id":  "ASB-A-527035500-d900547f",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "updateInputWindows"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-11-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "155796206884827581862290594705919952658",
                    "258376708425011540055784706506003999557",
                    "190463034497598129357766158062266265273",
                    "22337772173762286085833662387581230965",
                    "190189954155783960380060441543380672617",
                    "332642691688574217111063064427631775610",
                    "121283967486499349383677047753904849475",
                    "303221094357557600421929831122170490966",
                    "301896271490353770296190580674027387579",
                    "37401843178170364963321369118708025702",
                    "142055367928194779100611511472078757114",
                    "1230587935592434539656609165700564261",
                    "15123631972920053487156663525640308556",
                    "98703169714776422973753199938184122318",
                    "63680734119120047066360396110246234345",
                    "149201177999688568953790755275430478634",
                    "319286328522927019737868094328041970199",
                    "193027717932953653290304402387503672635",
                    "39851372060237890451892885445288139122",
                    "302228880997054128390934844952167022378",
                    "19337811763439585549291717282855770916",
                    "248403770536023356145853180184457508943",
                    "186165088315825507913991499019514171327",
                    "204227658261051614813094647512083919101",
                    "270335475701597709356600968192283707928",
                    "41455009785870283809491221383365354832",
                    "169293239471054143244352914876719839193",
                    "209715496126177217885166689802031448886",
                    "124776521846284429917844913909419589065"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527035500-29fe63f9",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "144882206472780664119034154537535057841",
                "length":  1339
            },
            "id":  "ASB-A-527035500-ae7b61c6",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "updateInputWindows"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "248183603591817373701342695682002415017",
                "length":  1534
            },
            "id":  "ASB-A-527035500-c454b36f",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "accept"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-11-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "248183603591817373701342695682002415017",
                "length":  1534
            },
            "id":  "ASB-A-527035500-08276dde",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "accept"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "155796206884827581862290594705919952658",
                    "258376708425011540055784706506003999557",
                    "190463034497598129357766158062266265273",
                    "22337772173762286085833662387581230965",
                    "190189954155783960380060441543380672617",
                    "332642691688574217111063064427631775610",
                    "121283967486499349383677047753904849475",
                    "303221094357557600421929831122170490966",
                    "301896271490353770296190580674027387579",
                    "37401843178170364963321369118708025702",
                    "142055367928194779100611511472078757114",
                    "1230587935592434539656609165700564261",
                    "15123631972920053487156663525640308556",
                    "98703169714776422973753199938184122318",
                    "63680734119120047066360396110246234345",
                    "149201177999688568953790755275430478634",
                    "319286328522927019737868094328041970199",
                    "193027717932953653290304402387503672635",
                    "39851372060237890451892885445288139122",
                    "302228880997054128390934844952167022378",
                    "19337811763439585549291717282855770916",
                    "248403770536023356145853180184457508943",
                    "186165088315825507913991499019514171327",
                    "204227658261051614813094647512083919101",
                    "270335475701597709356600968192283707928",
                    "41455009785870283809491221383365354832",
                    "169293239471054143244352914876719839193",
                    "209715496126177217885166689802031448886",
                    "124776521846284429917844913909419589065"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527035500-66fbfb94",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "144882206472780664119034154537535057841",
                "length":  1339
            },
            "id":  "ASB-A-527035500-7d32301f",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "updateInputWindows"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-11-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "155796206884827581862290594705919952658",
                    "258376708425011540055784706506003999557",
                    "190463034497598129357766158062266265273",
                    "22337772173762286085833662387581230965",
                    "190189954155783960380060441543380672617",
                    "332642691688574217111063064427631775610",
                    "121283967486499349383677047753904849475",
                    "303221094357557600421929831122170490966",
                    "301896271490353770296190580674027387579",
                    "37401843178170364963321369118708025702",
                    "142055367928194779100611511472078757114",
                    "1230587935592434539656609165700564261",
                    "15123631972920053487156663525640308556",
                    "98703169714776422973753199938184122318",
                    "63680734119120047066360396110246234345",
                    "149201177999688568953790755275430478634",
                    "319286328522927019737868094328041970199",
                    "193027717932953653290304402387503672635",
                    "39851372060237890451892885445288139122",
                    "302228880997054128390934844952167022378",
                    "19337811763439585549291717282855770916",
                    "248403770536023356145853180184457508943",
                    "186165088315825507913991499019514171327",
                    "204227658261051614813094647512083919101",
                    "270335475701597709356600968192283707928",
                    "41455009785870283809491221383365354832",
                    "169293239471054143244352914876719839193",
                    "209715496126177217885166689802031448886",
                    "124776521846284429917844913909419589065"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527035500-086cb4fc",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "144882206472780664119034154537535057841",
                "length":  1339
            },
            "id":  "ASB-A-527035500-22a30625",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "updateInputWindows"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "248183603591817373701342695682002415017",
                "length":  1534
            },
            "id":  "ASB-A-527035500-9f4a1d8f",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "accept"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"
platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-11-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d"
    ],
    "severity":  "High",
    "spl":  "2026-11-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "155796206884827581862290594705919952658",
                    "258376708425011540055784706506003999557",
                    "190463034497598129357766158062266265273",
                    "22337772173762286085833662387581230965",
                    "190189954155783960380060441543380672617",
                    "332642691688574217111063064427631775610",
                    "121283967486499349383677047753904849475",
                    "303221094357557600421929831122170490966",
                    "301896271490353770296190580674027387579",
                    "37401843178170364963321369118708025702",
                    "142055367928194779100611511472078757114",
                    "1230587935592434539656609165700564261",
                    "124553947969102158064592103505137299749",
                    "301272396204600008384223290607903337996",
                    "63680734119120047066360396110246234345",
                    "149201177999688568953790755275430478634",
                    "319286328522927019737868094328041970199",
                    "193027717932953653290304402387503672635",
                    "39851372060237890451892885445288139122",
                    "302228880997054128390934844952167022378",
                    "19337811763439585549291717282855770916",
                    "248403770536023356145853180184457508943",
                    "186165088315825507913991499019514171327",
                    "204227658261051614813094647512083919101",
                    "270335475701597709356600968192283707928",
                    "41455009785870283809491221383365354832",
                    "169293239471054143244352914876719839193",
                    "209715496126177217885166689802031448886",
                    "124776521846284429917844913909419589065"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-527035500-15a4f161",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "22451502225606759144343886265447794085",
                "length":  2099
            },
            "id":  "ASB-A-527035500-71bd43b7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "accept"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "219480815561105820345550148068414694461",
                "length":  1425
            },
            "id":  "ASB-A-527035500-c4d67568",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d",
            "target":  {
                "file":  "services/core/java/com/android/server/wm/InputMonitor.java",
                "function":  "updateInputWindows"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-527035500.json"