{"id":"ASB-A-277076451", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2025-22436", "A-277076451"], "details":"In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"27852702777802956446946993760532873183", "length":3315}, "id":"ASB-A-277076451-14e6aa0f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc", "target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp", "function":"LayerSnapshotBuilder::updateInput"}}, {"deprecated":false, "digest":{"line_hashes":["178919437617283077774877895910859052582", "111380456252735317263455197200840501304", "11244053416831306091967487469587689593", "6787638795401806036970479540044787961", "157783538096809031353643904907226018034", "23709466613914898636501949938533859201", "27527102925150114586211728883052581960"], "threshold":0.9}, "id":"ASB-A-277076451-4321dd33", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc", "target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"}}, {"deprecated":false, "digest":{"function_hash":"140989369876152881276210062576714665341", "length":404}, "id":"ASB-A-277076451-56979a93", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc", "target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp", "function":"RequestedLayerState::needsInputInfo"}}, {"deprecated":false, "digest":{"line_hashes":["138377031501569344570071156268305874328", "2287569253564120154783191341104865693", "170518268625803685578692170059566066171", "298886316803471864874505809069957904140"], "threshold":0.9}, "id":"ASB-A-277076451-9a3d5ff7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc", "target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["187115584872065835124258339878705788931", "114492998577407420746356399143929090242", "175412779704010986705270160749183400609", "26949142478832341270099466787117110"], "threshold":0.9}, "id":"ASB-A-277076451-ae2a6b73", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/1f0301b3f1061cb89d9628bbb1d2b4594f4f29dc", "target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.h"}}]}}, {"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8", "https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"76645456001427929680655107424504868681", "length":462}, "id":"ASB-A-277076451-0936ff76", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e", "target":{"file":"libs/gui/SurfaceControl.cpp", "function":"SurfaceControl::generateSurfaceLocked"}}, {"deprecated":false, "digest":{"line_hashes":["128135737400769776796077078207687502766", "149933555301995305922491793489941606608", "194558293354210483895911273661241305885", "285302210163662062327481270086288574014"], "threshold":0.9}, "id":"ASB-A-277076451-15a0f45f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8", "target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.h"}}, {"deprecated":false, "digest":{"line_hashes":["105220011585837361037938345749578822927", "311945601997285600475698222514156653856", "258870565328759151360944177947233954761", "169129871573380618306370308952581941680"], "threshold":0.9}, "id":"ASB-A-277076451-40d3af51", "match_only_versions":["15"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e", "target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"}}, {"deprecated":false, "digest":{"function_hash":"232550686492620791571962689886998322076", "length":3267}, "id":"ASB-A-277076451-61f7df36", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e", "target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp", "function":"LayerSnapshotBuilder::updateInput"}}, {"deprecated":false, "digest":{"function_hash":"101602075548295543404928190931550875268", "length":395}, "id":"ASB-A-277076451-aa8d583f", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e", "target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp", "function":"needsInputInfo"}}, {"deprecated":false, "digest":{"line_hashes":["108898984718019726123183869764267605390", "233123856869104002419687664905789284827", "262621183142731668483114808080114521273", "9567484725357046489592313641044482765", "298886316803471864874505809069957904140"], "threshold":0.9}, "id":"ASB-A-277076451-af99509b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8", "target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["255057014368123870940450721212444174840", "53911117399724226795170942851915673910", "94164455446402711450330084752025420066", "306053644074581509350521785520225180331", "80694592891549447935582136065173576100", "213952627722867001596811538066895889477"], "threshold":0.9}, "id":"ASB-A-277076451-baaea3db", "match_only_versions":["15"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e", "target":{"file":"libs/gui/SurfaceControl.cpp"}}, {"deprecated":false, "digest":{"line_hashes":["155044272526154480922187015190222489734", "18002860625520027555481073588300294508", "129223925621143283525818562399285453010", "328146188331462701753940805816234795411", "283035619929566102316203057203148959124", "127495867647857042393310844605953761491", "185147356067755367457988036883854598072", "256675309401884478960626620304567475386", "51953411527694178082713572231848516858", "257722548820873051954479846885572745439", "323892867020990830541419572875073874175", "90459806601142480500197760816188983533", "317274700460096653257852330161307790572", "167707650307608612990449037329628749457", "332486249985394067948336217829291010635", "284302643563821127506568401640145723057", "172452481224296751919078656886698200192", "68696661544520616266860396676175702255", "297772046054779024203931630979781582606", "190656762347268792022937212539546582989", "286439796831521652862346644373777956144"], "threshold":0.9}, "id":"ASB-A-277076451-bcd7e77d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e", "target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp"}}, {"deprecated":false, "digest":{"function_hash":"316561202100474119191796357055408884745", "length":3609}, "id":"ASB-A-277076451-bda0bd13", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/7c19e9d6acc92acf5a3be4f180bb5343b38ea24e", "target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp", "function":"RequestedLayerState::RequestedLayerState"}}, {"deprecated":false, "digest":{"function_hash":"314948560983223847531973593622176950972", "length":3266}, "id":"ASB-A-277076451-c9204a58", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8", "target":{"file":"services/surfaceflinger/FrontEnd/LayerSnapshotBuilder.cpp", "function":"LayerSnapshotBuilder::updateInput"}}, {"deprecated":false, "digest":{"line_hashes":["157783538096809031353643904907226018034", "23709466613914898636501949938533859201", "27527102925150114586211728883052581960"], "threshold":0.9}, "id":"ASB-A-277076451-ede5672e", "match_only_versions":["15"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/48797bfcf3bdb2083631b56dbd626e8840ac44d8", "target":{"file":"services/surfaceflinger/FrontEnd/RequestedLayerState.cpp"}}]}}, {"package":{"name":"platform/frameworks/native", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/1cb7e56804a41c98c71ef6c80eb2e44f0b1ac49d", "https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e"], "severity":"High", "spl":"2026-11-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["238525009910210859464347603952218061896", "16976057652902572481340380646462930379", "305715949065755907407256088028439688330", "128202053576384182953996719204114133783"], "threshold":0.9}, "id":"ASB-A-277076451-1f47c94a", "match_only_versions":["14"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/1cb7e56804a41c98c71ef6c80eb2e44f0b1ac49d", "target":{"file":"services/surfaceflinger/Layer.h"}}, {"deprecated":false, "digest":{"function_hash":"27936929993929874048716326856280822663", "length":92}, "id":"ASB-A-277076451-37b20ed6", "match_only_versions":["14"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/1cb7e56804a41c98c71ef6c80eb2e44f0b1ac49d", "target":{"file":"services/surfaceflinger/Layer.h", "function":"needsInputInfo"}}, {"deprecated":false, "digest":{"function_hash":"215710529749722061207344159036774039737", "length":313}, "id":"ASB-A-277076451-37da4312", "match_only_versions":["14"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e", "target":{"file":"services/surfaceflinger/Layer.cpp", "function":"Layer::setInputInfo"}}, {"deprecated":false, "digest":{"line_hashes":["93683255474763354072849610301527133844", "68114928085856032543212733903025427514", "292651427328025016645012563244481190536", "152170461307441087749580560470543607822", "21854129723508503117681102296993850823", "86661735225991697357452502539957603076", "302125276945752472208804497344413458891", "274941069939674782230662735421341614294", "285974249813489313830360987010569833441", "167637840218581818769479152679384229892", "249157280252713861571118657571353857671"], "threshold":0.9}, "id":"ASB-A-277076451-6ea29d1d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e", "target":{"file":"services/surfaceflinger/Layer.h"}}, {"deprecated":false, "digest":{"line_hashes":["87037403875122739289451646358262770844", "323099327199382606268971549381274573943", "160231120480841555251235532301425083989", "149618833907063867181547771518633021012", "24291380174787456921442931217888800450", "205002071888333412311357636307298151624", "40040684718506752338375500701912096594", "16861210677265303421161563316125873201"], "threshold":0.9}, "id":"ASB-A-277076451-8416a118", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/native/+/5c16295381ce4e5e04b232950d469a2e22b80c9e", "target":{"file":"services/surfaceflinger/Layer.cpp"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}