{"id":"ASB-A-405392600", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-09T15:27:06.151355248Z", "aliases":["CVE-2026-0036", "A-405392600"], "details":"In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/3be8f7ff61baa3a98320de393a94735aecc6e77c"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"307110352914677260204125420269224047833", "length":5314}, "id":"ASB-A-405392600-a4d2eec2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3be8f7ff61baa3a98320de393a94735aecc6e77c", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java", "function":"startAnimation"}}, {"deprecated":false, "digest":{"line_hashes":["196834800934499512401249703690353402776", "53800243681986578973638540609664851654", "30945154683274107557620767714865022409", "25920037041630569851527813329817975309", "264753023589251046938758459268495951557", "92360547457962659164697384821767116808", "278944544124777527876046268260362601255", "192914089220059111923475337081443309263", "85118904142547979141340432401522893834"], "threshold":0.9}, "id":"ASB-A-405392600-e938b26c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3be8f7ff61baa3a98320de393a94735aecc6e77c", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"200256576980199633511250134072010924083", "length":959}, "id":"ASB-A-405392600-289391f0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java", "function":"StageCoordinator"}}, {"deprecated":false, "digest":{"line_hashes":["94499919690297704469328890313529712110", "223644107047342772176529808333539353932", "61693059786144883367462358733407368842", "74027056211580294426523386286213487092", "220784762026793465380558929547702214099", "154314517670998619360208194434236507315", "143454919783250357699654915245625515593", "67690817930865624100864444597899473908", "321025809858375577747017341072559954411", "68731163320469398113454798746270171375", "302011751558441188943875649047930433626", "249566287001256496614460919273593129073", "96830722721993081390165605108868332262", "212366543043209844071033670495621796210", "302011751558441188943875649047930433626", "194171177533092460531665981216334981725", "254478536588815336192906194395773505676", "38005616853806467836966517160243520536", "69532484967583811878219865071959654805", "43687536184342139642152867007761407322"], "threshold":0.9}, "id":"ASB-A-405392600-3bedab9e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"}}, {"deprecated":false, "digest":{"function_hash":"11177246840131358714967682356840276912", "length":1547}, "id":"ASB-A-405392600-6cbb4ea7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java", "function":"StageCoordinator"}}, {"deprecated":false, "digest":{"function_hash":"119816627596400220211526870256072744673", "length":3727}, "id":"ASB-A-405392600-70f41a58", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java", "function":"startAnimation"}}, {"deprecated":false, "digest":{"line_hashes":["332514508025218394710007622616753523075", "339386023105424134433422368575210967105", "119757193032673000187464040791551055017", "213574414285756692981460083597306495482"], "threshold":0.9}, "id":"ASB-A-405392600-e5d91ec0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6d8942c121f60a82e7de9ba83d81b860b713b541", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageTaskListener.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/260c1e81ccaee07cac1bc8de20187f44f343f09d"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["196834800934499512401249703690353402776", "53800243681986578973638540609664851654", "39882914833753962973421883567473073341", "170978874624033054880904752284089797686", "264753023589251046938758459268495951557", "92360547457962659164697384821767116808", "278944544124777527876046268260362601255", "192914089220059111923475337081443309263", "85118904142547979141340432401522893834"], "threshold":0.9}, "id":"ASB-A-405392600-1f37694f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/260c1e81ccaee07cac1bc8de20187f44f343f09d", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"}}, {"deprecated":false, "digest":{"function_hash":"306008240040097613830486535496724852458", "length":5331}, "id":"ASB-A-405392600-7f699025", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/260c1e81ccaee07cac1bc8de20187f44f343f09d", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java", "function":"startAnimation"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8e2cb82b544c443312d6d229e67bcf3d2cd56843"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["196834800934499512401249703690353402776", "53800243681986578973638540609664851654", "30945154683274107557620767714865022409", "25920037041630569851527813329817975309", "264753023589251046938758459268495951557", "92360547457962659164697384821767116808", "278944544124777527876046268260362601255", "192914089220059111923475337081443309263", "85118904142547979141340432401522893834"], "threshold":0.9}, "id":"ASB-A-405392600-d8d99611", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8e2cb82b544c443312d6d229e67bcf3d2cd56843", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"}}, {"deprecated":false, "digest":{"function_hash":"10986556182857700889922712942182990819", "length":5474}, "id":"ASB-A-405392600-d94921a8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/8e2cb82b544c443312d6d229e67bcf3d2cd56843", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java", "function":"startAnimation"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"96258137169049472265897891995057180961", "length":3114}, "id":"ASB-A-405392600-2ac0e4ba", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java", "function":"startAnimation"}}, {"deprecated":false, "digest":{"line_hashes":["242287264711416719263041639547230489040", "153455352669136730683556758107487076414", "119757193032673000187464040791551055017", "213574414285756692981460083597306495482"], "threshold":0.9}, "id":"ASB-A-405392600-4bde0776", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageTaskListener.java"}}, {"deprecated":false, "digest":{"function_hash":"233077854123749515899633287732957235013", "length":1322}, "id":"ASB-A-405392600-d78e6556", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java", "function":"StageCoordinator"}}, {"deprecated":false, "digest":{"function_hash":"206903133592589499782802830159529961002", "length":863}, "id":"ASB-A-405392600-f6bffd82", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java", "function":"StageCoordinator"}}, {"deprecated":false, "digest":{"line_hashes":["271049556893542636157167826222580523104", "188606234207985012251090737069440151640", "36984586390521816650608175486469870898", "119519604842057829123414476545095272719", "96691153340318844249998119179124601413", "33206300867112779391273574561610251391", "61693059786144883367462358733407368842", "74027056211580294426523386286213487092", "170202074854778136268736953150312446955", "173612082838792809985396654531375628867", "292585950027804735890917845702517712905", "183839358493519301610242601473229862753", "321025809858375577747017341072559954411", "68731163320469398113454798746270171375", "302011751558441188943875649047930433626", "249566287001256496614460919273593129073", "76922199718685550758807023169323586217", "79069259876957789821402893829705789471", "302011751558441188943875649047930433626", "194171177533092460531665981216334981725", "254478536588815336192906194395773505676", "80780765245875944920230006771042030477", "275529923052970153285405197698653732853", "258716876955811455083242805139591387377"], "threshold":0.9}, "id":"ASB-A-405392600-fb40d545", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/f60c7771358ce3e5b84e4fe1f57f6f41da985841", "target":{"file":"libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageCoordinator.java"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}]}