{"id":"ASB-A-438973280", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-12T15:08:17.296522730Z", "aliases":["CVE-2025-48616", "A-438973280"], "details":"In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"62065052189309584053778982792654750880", "length":2920}, "id":"ASB-A-438973280-254fedbb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"doKeyguardLocked"}}, {"deprecated":false, "digest":{"function_hash":"187740487069481619775985710964898753634", "length":1312}, "id":"ASB-A-438973280-5675988f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"setKeyguardEnabled"}}, {"deprecated":false, "digest":{"function_hash":"144717035925538850326922822744760286648", "length":205}, "id":"ASB-A-438973280-5de8e2bd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"onStrongAuthStateChanged"}}, {"deprecated":false, "digest":{"line_hashes":["209003653409485814053874828966339831762", "248157843896045004288509290425769454425", "295819614806895111282634632024505080583", "33054126993467952584247571675358090874", "157308877314888095909473701707830601155", "302452540552734798692213935741771649446", "178207226253972502873616493127000158293", "1163217655246275190591404310621043494", "320063222130511664022688046149485038347", "63286039853862214767875888942314506820", "38851795789724782623423941453576972444", "289951149868027652041402854077089503975"], "threshold":0.9}, "id":"ASB-A-438973280-8d5adee9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/5c25e76eb886ad3508103b486b146b6920c8c651", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"187740487069481619775985710964898753634", "length":1312}, "id":"ASB-A-438973280-1237e20a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"setKeyguardEnabled"}}, {"deprecated":false, "digest":{"function_hash":"9534616859167290042442020910009650438", "length":2458}, "id":"ASB-A-438973280-3e50391a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"doKeyguardLocked"}}, {"deprecated":false, "digest":{"function_hash":"136313731282049621704943676923449853035", "length":137}, "id":"ASB-A-438973280-7fbb6a41", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"onStrongAuthStateChanged"}}, {"deprecated":false, "digest":{"line_hashes":["328443085910941181851152407178313554967", "35067794694172749795438568066573731753", "218896132632949222370235331652783459150", "33054126993467952584247571675358090874", "157308877314888095909473701707830601155", "302452540552734798692213935741771649446", "178207226253972502873616493127000158293", "1163217655246275190591404310621043494", "320063222130511664022688046149485038347", "63286039853862214767875888942314506820", "38851795789724782623423941453576972444", "289951149868027652041402854077089503975"], "threshold":0.9}, "id":"ASB-A-438973280-a39d99f7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/913e72f1bee7f8a1b1bde3b1a04584e7fb891b10", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"136313731282049621704943676923449853035", "length":137}, "id":"ASB-A-438973280-6b93965b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"onStrongAuthStateChanged"}}, {"deprecated":false, "digest":{"function_hash":"187740487069481619775985710964898753634", "length":1312}, "id":"ASB-A-438973280-cbdb6460", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"setKeyguardEnabled"}}, {"deprecated":false, "digest":{"line_hashes":["328443085910941181851152407178313554967", "35067794694172749795438568066573731753", "218896132632949222370235331652783459150", "33054126993467952584247571675358090874", "157308877314888095909473701707830601155", "302452540552734798692213935741771649446", "178207226253972502873616493127000158293", "1163217655246275190591404310621043494", "320063222130511664022688046149485038347", "63286039853862214767875888942314506820", "38851795789724782623423941453576972444", "289951149868027652041402854077089503975"], "threshold":0.9}, "id":"ASB-A-438973280-ed8aa31e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"}}, {"deprecated":false, "digest":{"function_hash":"19444794359538423208616869984122610262", "length":2787}, "id":"ASB-A-438973280-f05f514a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0f374bee23728a5e9cd5e61ec5e0c5b702e08905", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"doKeyguardLocked"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"62065052189309584053778982792654750880", "length":2920}, "id":"ASB-A-438973280-250f3531", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"doKeyguardLocked"}}, {"deprecated":false, "digest":{"line_hashes":["209003653409485814053874828966339831762", "248157843896045004288509290425769454425", "295819614806895111282634632024505080583", "33054126993467952584247571675358090874", "157308877314888095909473701707830601155", "302452540552734798692213935741771649446", "178207226253972502873616493127000158293", "1163217655246275190591404310621043494", "320063222130511664022688046149485038347", "63286039853862214767875888942314506820", "38851795789724782623423941453576972444", "289951149868027652041402854077089503975"], "threshold":0.9}, "id":"ASB-A-438973280-2d0a3a4b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"}}, {"deprecated":false, "digest":{"function_hash":"187740487069481619775985710964898753634", "length":1312}, "id":"ASB-A-438973280-7f0e9bc5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"setKeyguardEnabled"}}, {"deprecated":false, "digest":{"function_hash":"144717035925538850326922822744760286648", "length":205}, "id":"ASB-A-438973280-8ffb71c3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/14f4359119d5864072322da14527eac786c78a26", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"onStrongAuthStateChanged"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc"], "severity":"High", "spl":"2026-06-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"28355018146740837997510255390809824199", "length":2452}, "id":"ASB-A-438973280-0fe5ac68", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"doKeyguardLocked"}}, {"deprecated":false, "digest":{"function_hash":"74706416706882606468745504616270143627", "length":1310}, "id":"ASB-A-438973280-72be80c2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"setKeyguardEnabled"}}, {"deprecated":false, "digest":{"line_hashes":["38867570063675643553038483487100176832", "163776543271928782038002134823982461851", "199000920925165640654848569466156005191", "215446848326935019446492765767272069821", "32506973252840195140735957884626071389", "12350634736937558266771328155721071284", "199432919809092178067366540515146144839", "280601339876405487838658475878899190765", "220569421737926242352480083075105166400", "315734703629131880403629904844485908198", "223781247095430728760283417532866046923", "190167032595858610910918531959616276798"], "threshold":0.9}, "id":"ASB-A-438973280-8e51eb3f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java"}}, {"deprecated":false, "digest":{"function_hash":"286915552132051646324387458920861407957", "length":135}, "id":"ASB-A-438973280-c391b580", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/52a6d6dfda83c584c99a39321f85bb235c6667fc", "target":{"file":"packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java", "function":"onStrongAuthStateChanged"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/aa9fbb1b74eb11ce0bd48f0c4cab43fc32a23b4e"}]}