{"id":"ASB-A-464526458", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-0065", "A-464526458"], "details":"In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["73046504618660582395574844777253315374", "330387405518780465397403390363762478756", "215890888295206688476670566225914578557", "180800775238810118100131782244407644837"], "threshold":0.9}, "id":"ASB-A-464526458-0b7141e4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"}}, {"deprecated":false, "digest":{"function_hash":"143380978350973373013440701584546112244", "length":1324}, "id":"ASB-A-464526458-2cfca4f6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"areBackgroundActivityStartsAllowed"}}, {"deprecated":false, "digest":{"line_hashes":["146769040500021787528545105549259973868", "182325258103073499909270517816673883219", "284864839436383791561624235069037153809", "211660263292507573797006478975017090501", "283708962198578721655982350975381204609", "151246692116000714145758709506519188041", "75764128462750765707573704157076991346", "49209169815236049901648328848139260706", "228649580167071546740086712885126606374", "116817328366553531740104663848123646376", "175762470153445334763409674220116161417", "70263026317357662030265406059344814676", "149936038488966642756316536744704199116", "178498502371138113737600816739126287684", "110422244730757250624945615794147314957", "238280979789010909138282512357853600217", "72876531201846381436074926870788598644", "293250796321213382903584523752051680385", "231912993505126684309873105459441858933", "138958301752926086560920109173342050953", "58838867726842286788809732133561429456"], "threshold":0.9}, "id":"ASB-A-464526458-981fbdad", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"}}, {"deprecated":false, "digest":{"function_hash":"47341408136498732326287502129607834834", "length":674}, "id":"ASB-A-464526458-a4284d5d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java", "function":"WindowProcessController"}}, {"deprecated":false, "digest":{"function_hash":"197684456420924789431075614136860390978", "length":315}, "id":"ASB-A-464526458-ace83611", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"isBoundByForegroundUid"}}, {"deprecated":false, "digest":{"function_hash":"314235660009376757178028004664370744928", "length":152}, "id":"ASB-A-464526458-f4a2a9fd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/370b39d74a55d5e16bd1d71c36810eec0505c682", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"BackgroundLaunchProcessController"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195", "https://android.googlesource.com/platform/frameworks/base/+/66e70ef81382ada56496c7bc4225eb4a5e84e248"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["99162038471083773699272782685744667264", "80205655137540829656108104452242663589", "314235919336652542099470259239881947604", "326415240541677075291145333357835595569", "269919879288557531431549615596513720539", "102857065816403933007667912064713155348", "284864839436383791561624235069037153809", "211660263292507573797006478975017090501", "283708962198578721655982350975381204609", "151246692116000714145758709506519188041", "75764128462750765707573704157076991346", "49209169815236049901648328848139260706", "105883670696038004159354055967862803339", "255984591127679450019907135772877356305", "58866903693935143842157161898770863212", "257277103302453843338359185206915243115", "248545751631401845904730627242372349412", "9047606762293242906155535157480681504", "264194205621035045373163381903991372408", "142117258438042846578136794806834282324", "98223113605773475332000554373383288748", "178498502371138113737600816739126287684", "110422244730757250624945615794147314957", "238280979789010909138282512357853600217", "72876531201846381436074926870788598644", "293250796321213382903584523752051680385", "231912993505126684309873105459441858933", "138958301752926086560920109173342050953", "58838867726842286788809732133561429456"], "threshold":0.9}, "id":"ASB-A-464526458-274ec9e4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"}}, {"deprecated":false, "digest":{"function_hash":"197684456420924789431075614136860390978", "length":315}, "id":"ASB-A-464526458-33be2fa7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"isBoundByForegroundUid"}}, {"deprecated":false, "digest":{"function_hash":"254180117488952461526885384663677660079", "length":795}, "id":"ASB-A-464526458-5d723dbd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java", "function":"WindowProcessController"}}, {"deprecated":false, "digest":{"function_hash":"127515804240571674148418957220075186992", "length":1388}, "id":"ASB-A-464526458-86a80a9e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"areBackgroundActivityStartsAllowed"}}, {"deprecated":false, "digest":{"function_hash":"314235660009376757178028004664370744928", "length":152}, "id":"ASB-A-464526458-940cb9e0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"BackgroundLaunchProcessController"}}, {"deprecated":false, "digest":{"line_hashes":["73046504618660582395574844777253315374", "330387405518780465397403390363762478756", "215890888295206688476670566225914578557", "180800775238810118100131782244407644837"], "threshold":0.9}, "id":"ASB-A-464526458-a7e97c5c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7153bc6d283869f9eea61dfc8f42229c62952195", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87", "https://android.googlesource.com/platform/frameworks/base/+/e26dda735b99edd974444462ce5b333dbbd3aa6a"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"197684456420924789431075614136860390978", "length":315}, "id":"ASB-A-464526458-0dd0400d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"isBoundByForegroundUid"}}, {"deprecated":false, "digest":{"function_hash":"47341408136498732326287502129607834834", "length":674}, "id":"ASB-A-464526458-6573dc35", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java", "function":"WindowProcessController"}}, {"deprecated":false, "digest":{"line_hashes":["269919879288557531431549615596513720539", "102857065816403933007667912064713155348", "284864839436383791561624235069037153809", "211660263292507573797006478975017090501", "283708962198578721655982350975381204609", "151246692116000714145758709506519188041", "75764128462750765707573704157076991346", "49209169815236049901648328848139260706", "228649580167071546740086712885126606374", "116817328366553531740104663848123646376", "122376956380815320468047852860214196351", "234894974799769630399468878050193128926", "160058135940036580118892726299854706698", "178498502371138113737600816739126287684", "110422244730757250624945615794147314957", "238280979789010909138282512357853600217", "72876531201846381436074926870788598644", "293250796321213382903584523752051680385", "231912993505126684309873105459441858933", "138958301752926086560920109173342050953", "58838867726842286788809732133561429456"], "threshold":0.9}, "id":"ASB-A-464526458-672743d1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"}}, {"deprecated":false, "digest":{"line_hashes":["73046504618660582395574844777253315374", "330387405518780465397403390363762478756", "215890888295206688476670566225914578557", "180800775238810118100131782244407644837"], "threshold":0.9}, "id":"ASB-A-464526458-7cda60a8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"}}, {"deprecated":false, "digest":{"function_hash":"212149598703801142655170959717874680712", "length":1402}, "id":"ASB-A-464526458-c5f70e5f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"areBackgroundActivityStartsAllowed"}}, {"deprecated":false, "digest":{"function_hash":"314235660009376757178028004664370744928", "length":152}, "id":"ASB-A-464526458-f794b764", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/146d9a1f2dd90e9f259f92955a660f705c5d5f87", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"BackgroundLaunchProcessController"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"314235660009376757178028004664370744928", "length":152}, "id":"ASB-A-464526458-004d668c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"BackgroundLaunchProcessController"}}, {"deprecated":false, "digest":{"line_hashes":["269919879288557531431549615596513720539", "102857065816403933007667912064713155348", "284864839436383791561624235069037153809", "211660263292507573797006478975017090501", "283708962198578721655982350975381204609", "151246692116000714145758709506519188041", "75764128462750765707573704157076991346", "49209169815236049901648328848139260706", "228649580167071546740086712885126606374", "116817328366553531740104663848123646376", "175762470153445334763409674220116161417", "70263026317357662030265406059344814676", "149936038488966642756316536744704199116", "178498502371138113737600816739126287684", "110422244730757250624945615794147314957", "238280979789010909138282512357853600217", "72876531201846381436074926870788598644", "293250796321213382903584523752051680385", "231912993505126684309873105459441858933", "138958301752926086560920109173342050953", "58838867726842286788809732133561429456"], "threshold":0.9}, "id":"ASB-A-464526458-1d5fbe23", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"}}, {"deprecated":false, "digest":{"function_hash":"47341408136498732326287502129607834834", "length":674}, "id":"ASB-A-464526458-48ed9745", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java", "function":"WindowProcessController"}}, {"deprecated":false, "digest":{"function_hash":"143380978350973373013440701584546112244", "length":1324}, "id":"ASB-A-464526458-baf6c471", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"areBackgroundActivityStartsAllowed"}}, {"deprecated":false, "digest":{"line_hashes":["73046504618660582395574844777253315374", "330387405518780465397403390363762478756", "215890888295206688476670566225914578557", "180800775238810118100131782244407644837"], "threshold":0.9}, "id":"ASB-A-464526458-e9b8806e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"}}, {"deprecated":false, "digest":{"function_hash":"197684456420924789431075614136860390978", "length":315}, "id":"ASB-A-464526458-faa0f3de", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/844a0f84b3fe427c672456a9d8dace81713b96f5", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"isBoundByForegroundUid"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"72462734984194906042362744320471711572", "length":1759}, "id":"ASB-A-464526458-2678ef65", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"areBackgroundActivityStartsAllowed"}}, {"deprecated":false, "digest":{"line_hashes":["269919879288557531431549615596513720539", "102857065816403933007667912064713155348", "284864839436383791561624235069037153809", "211660263292507573797006478975017090501", "283708962198578721655982350975381204609", "151246692116000714145758709506519188041", "75764128462750765707573704157076991346", "49209169815236049901648328848139260706", "257653025265942308526684579097091622214", "197613014809239923350346780103550900195", "275861114373772380191480492836790634733", "70939824290936514268685772562913864706", "254690565360647050784500274569503610406", "178498502371138113737600816739126287684", "110422244730757250624945615794147314957", "238280979789010909138282512357853600217", "72876531201846381436074926870788598644", "293250796321213382903584523752051680385", "231912993505126684309873105459441858933", "138958301752926086560920109173342050953", "58838867726842286788809732133561429456"], "threshold":0.9}, "id":"ASB-A-464526458-375da634", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java"}}, {"deprecated":false, "digest":{"function_hash":"314235660009376757178028004664370744928", "length":152}, "id":"ASB-A-464526458-54c729dc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"BackgroundLaunchProcessController"}}, {"deprecated":false, "digest":{"line_hashes":["73046504618660582395574844777253315374", "330387405518780465397403390363762478756", "215890888295206688476670566225914578557", "180800775238810118100131782244407644837"], "threshold":0.9}, "id":"ASB-A-464526458-822b2dd1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java"}}, {"deprecated":false, "digest":{"function_hash":"205441195860207224400870271790685422467", "length":676}, "id":"ASB-A-464526458-bfe10e92", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70", "target":{"file":"services/core/java/com/android/server/wm/WindowProcessController.java", "function":"WindowProcessController"}}, {"deprecated":false, "digest":{"function_hash":"197684456420924789431075614136860390978", "length":315}, "id":"ASB-A-464526458-ed060327", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/1cc288c18fbac42fecbe4f0d92ef6e9cabcd1f70", "target":{"file":"services/core/java/com/android/server/wm/BackgroundLaunchProcessController.java", "function":"isBoundByForegroundUid"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}