{"id":"ASB-A-376048041", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-12T15:08:17.296522730Z", "aliases":["CVE-2025-48570", "A-376048041"], "details":"In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1", "https://android.googlesource.com/platform/frameworks/base/+/6b3066f8d199b17853992fc121f85bfa9aa43136", "https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["269441865083221342326649577408145318077", "156028149703521146675302373922355731176", "225142177803471708763815187234494831067", "86456216060200998801052865306828085812", "284311963398253730348276618691952946244", "276680722652991468837962084545001934614", "236294929586587556930146569612945389373", "87118459847215512901729674145684266933", "24012896710107546920510062811017547571", "284117436700839151443346954822213275980", "142390309047380255238570596373879287290", "28214925196935934081409457351289558849", "107595101497419692725034617107836312544", "113664377780682502555612390814443940370", "154601613639577492178775769089451278614", "37010348331977835696228704116407514139", "333319740463213949623442906026781860136"], "threshold":0.9}, "id":"ASB-A-376048041-1e5ec15e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java"}}, {"deprecated":false, "digest":{"function_hash":"146247374016712456008217424681411651440", "length":1534}, "id":"ASB-A-376048041-3879e528", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java", "function":"PipTaskOrganizer"}}, {"deprecated":false, "digest":{"function_hash":"146247374016712456008217424681411651440", "length":1534}, "id":"ASB-A-376048041-97389212", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java", "function":"PipTaskOrganizer"}}, {"deprecated":false, "digest":{"line_hashes":["269441865083221342326649577408145318077", "156028149703521146675302373922355731176", "225142177803471708763815187234494831067", "86456216060200998801052865306828085812", "284311963398253730348276618691952946244", "276680722652991468837962084545001934614", "236294929586587556930146569612945389373", "87118459847215512901729674145684266933", "24012896710107546920510062811017547571", "284117436700839151443346954822213275980", "142390309047380255238570596373879287290", "28214925196935934081409457351289558849", "107595101497419692725034617107836312544", "113664377780682502555612390814443940370", "154601613639577492178775769089451278614", "37010348331977835696228704116407514139", "333319740463213949623442906026781860136"], "threshold":0.9}, "id":"ASB-A-376048041-c3d4ea5d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java"}}, {"deprecated":false, "digest":{"function_hash":"199300417606562923587179034825898273583", "length":3449}, "id":"ASB-A-376048041-c9b2afa8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6b3066f8d199b17853992fc121f85bfa9aa43136", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java", "function":"onTaskAppeared"}}, {"deprecated":false, "digest":{"line_hashes":["180219592113640461097893359970873960623", "195894146686590343361764087726600971076", "30689948491166592403583923642656274044", "276974954893670556217485962181940104166", "30514597363130404269704632993379325419", "87634651897060899545778323288807035198", "181711378393630417383222112923096816112", "311590496053789182717998329944433641066", "194924281044677760179636975132016521909", "310050125723998703389278272993684594203", "74372822711773720336203741019167734284", "52198168245931113607322411447672367691", "114341721661609098826279358073033232412", "101909345364621187262183070453044962243", "193678400460692395289069624140453326533", "43373005389999957244497533249623070270", "58463539496980679591815254265170877759", "335121423655335720842034799587906370202", "224737870082030916607889451494456161382", "210925256920358820371288855079134919106", "247069501667618065590633464510913664539", "308251549669097979824626467344850405310", "214208758342627681801920162758297514389", "326098138363640393073588723479544544849", "290599586230745918191140170592184199158", "233414161293627538116823167116836083340", "97691685774373846913778784202380157086", "226986306722274493215689753423878442163", "217937712377750734768339320193208695424", "308155636303884874614400196748616084018", "187675970223052046877662680865087673850", "45683765107764377968434683969471188540", "245553796172791036065834118837644025654", "172550656236282798206579420245136799228", "23463598833202747865429744302755114321", "325613873942686862235563969548867158901", "170656104189663599275283758039336726805", "164802573160246728527776408548487646988", "161029281550041250738751561158801670194", "131854211668154657969872869572948724471", "48391509318112473858154044798423826240", "256475901771657372804955980937893007878", "249740194137442961801173305405632555421", "6803814013952655354307906626023491935", "6058704720784170960832128907614431951", "23437065534193608067251769847222532940", "258207890934716088662034845783348994518", "291365812812237620006593258198261989675"], "threshold":0.9}, "id":"ASB-A-376048041-d4737e28", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6b3066f8d199b17853992fc121f85bfa9aa43136", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java"}}, {"deprecated":false, "digest":{"function_hash":"45977743421367724954429051316492832010", "length":2712}, "id":"ASB-A-376048041-e2961efe", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1451fd2024faebf940f439c71c4775e603709e34", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java", "function":"onTaskAppeared"}}, {"deprecated":false, "digest":{"function_hash":"45977743421367724954429051316492832010", "length":2712}, "id":"ASB-A-376048041-eefb8fdd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c38e7078d853c1b22ee7d139c85b08ab669f89d1", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java", "function":"onTaskAppeared"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/c0f88bec3bf04db6a1ba3fad276dcde898de0f5e"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/94929458bc265ddf2962b35d5cda67751ee46fb6"}]}