{"id":"ASB-A-493714520", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28650", "A-493714520"], "details":"In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/617b18b15e675266e52fd88b69506ad7d5f86778"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["43059124052323866583417567636333074251", "334659300207295117288970136873278313255", "267049085029665571361173817413210894093", "133579854157735057935224292295453503209", "68084759512144536888960179930788167211", "337418779167730009292259489668165392662"], "threshold":0.9}, "id":"ASB-A-493714520-5eab47af", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/617b18b15e675266e52fd88b69506ad7d5f86778", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"222249259106316358477476803341054415810", "length":329}, "id":"ASB-A-493714520-f77880be", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/617b18b15e675266e52fd88b69506ad7d5f86778", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"setHiddenWhileSuspended"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/372c0fdbf48e9a7d40a93338fc37fd5a70a3892b"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["43059124052323866583417567636333074251", "334659300207295117288970136873278313255", "267049085029665571361173817413210894093", "133579854157735057935224292295453503209", "68084759512144536888960179930788167211", "337418779167730009292259489668165392662"], "threshold":0.9}, "id":"ASB-A-493714520-8da3ab20", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/372c0fdbf48e9a7d40a93338fc37fd5a70a3892b", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"222249259106316358477476803341054415810", "length":329}, "id":"ASB-A-493714520-bd92e9ec", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/372c0fdbf48e9a7d40a93338fc37fd5a70a3892b", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"setHiddenWhileSuspended"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ec19d18c4ca34691f7c6ceb24fada48d66d3f296"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["43059124052323866583417567636333074251", "334659300207295117288970136873278313255", "267049085029665571361173817413210894093", "133579854157735057935224292295453503209", "68084759512144536888960179930788167211", "337418779167730009292259489668165392662"], "threshold":0.9}, "id":"ASB-A-493714520-330dc914", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ec19d18c4ca34691f7c6ceb24fada48d66d3f296", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"222249259106316358477476803341054415810", "length":329}, "id":"ASB-A-493714520-3392678f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ec19d18c4ca34691f7c6ceb24fada48d66d3f296", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"setHiddenWhileSuspended"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/7061f4e08be7ffa9b98ea4b40dc5662677ca0d85"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["43059124052323866583417567636333074251", "334659300207295117288970136873278313255", "267049085029665571361173817413210894093", "133579854157735057935224292295453503209", "68084759512144536888960179930788167211", "337418779167730009292259489668165392662"], "threshold":0.9}, "id":"ASB-A-493714520-4eb28a7a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7061f4e08be7ffa9b98ea4b40dc5662677ca0d85", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"222249259106316358477476803341054415810", "length":329}, "id":"ASB-A-493714520-e46b073a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/7061f4e08be7ffa9b98ea4b40dc5662677ca0d85", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"setHiddenWhileSuspended"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/767984f9160ccd92aa6dcc3fffdf6e8d94aaaff2"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["43059124052323866583417567636333074251", "334659300207295117288970136873278313255", "267049085029665571361173817413210894093", "133579854157735057935224292295453503209", "68084759512144536888960179930788167211", "337418779167730009292259489668165392662"], "threshold":0.9}, "id":"ASB-A-493714520-a9e34702", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/767984f9160ccd92aa6dcc3fffdf6e8d94aaaff2", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"222249259106316358477476803341054415810", "length":329}, "id":"ASB-A-493714520-d13439f8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/767984f9160ccd92aa6dcc3fffdf6e8d94aaaff2", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"setHiddenWhileSuspended"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/005d5379546ba46422393874b5e08e71d26f4cfd"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["43059124052323866583417567636333074251", "334659300207295117288970136873278313255", "267049085029665571361173817413210894093", "133579854157735057935224292295453503209", "68084759512144536888960179930788167211", "337418779167730009292259489668165392662"], "threshold":0.9}, "id":"ASB-A-493714520-643b5c3b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/005d5379546ba46422393874b5e08e71d26f4cfd", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"222249259106316358477476803341054415810", "length":329}, "id":"ASB-A-493714520-f024bab3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/005d5379546ba46422393874b5e08e71d26f4cfd", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"setHiddenWhileSuspended"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}