{"id":"ASB-A-527035500", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58886", "A-527035500"], "details":"In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["155796206884827581862290594705919952658", "258376708425011540055784706506003999557", "190463034497598129357766158062266265273", "22337772173762286085833662387581230965", "190189954155783960380060441543380672617", "332642691688574217111063064427631775610", "121283967486499349383677047753904849475", "303221094357557600421929831122170490966", "301896271490353770296190580674027387579", "37401843178170364963321369118708025702", "142055367928194779100611511472078757114", "1230587935592434539656609165700564261", "15123631972920053487156663525640308556", "98703169714776422973753199938184122318", "63680734119120047066360396110246234345", "149201177999688568953790755275430478634", "319286328522927019737868094328041970199", "193027717932953653290304402387503672635", "39851372060237890451892885445288139122", "302228880997054128390934844952167022378", "19337811763439585549291717282855770916", "248403770536023356145853180184457508943", "186165088315825507913991499019514171327", "204227658261051614813094647512083919101", "270335475701597709356600968192283707928", "41455009785870283809491221383365354832", "169293239471054143244352914876719839193", "209715496126177217885166689802031448886", "124776521846284429917844913909419589065"], "threshold":0.9}, "id":"ASB-A-527035500-46199987", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"187651833792784998513636090874008109862", "length":1559}, "id":"ASB-A-527035500-7c9fb830", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"accept"}}, {"deprecated":false, "digest":{"function_hash":"144882206472780664119034154537535057841", "length":1339}, "id":"ASB-A-527035500-e5f39fb4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cfe63edd28f3259cfa104a1ab5f70acec3eafcf4", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"updateInputWindows"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"22451502225606759144343886265447794085", "length":2099}, "id":"ASB-A-527035500-a3dd6440", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"accept"}}, {"deprecated":false, "digest":{"line_hashes":["155796206884827581862290594705919952658", "258376708425011540055784706506003999557", "190463034497598129357766158062266265273", "22337772173762286085833662387581230965", "190189954155783960380060441543380672617", "332642691688574217111063064427631775610", "121283967486499349383677047753904849475", "303221094357557600421929831122170490966", "301896271490353770296190580674027387579", "37401843178170364963321369118708025702", "142055367928194779100611511472078757114", "1230587935592434539656609165700564261", "124553947969102158064592103505137299749", "301272396204600008384223290607903337996", "63680734119120047066360396110246234345", "149201177999688568953790755275430478634", "319286328522927019737868094328041970199", "193027717932953653290304402387503672635", "39851372060237890451892885445288139122", "302228880997054128390934844952167022378", "19337811763439585549291717282855770916", "248403770536023356145853180184457508943", "186165088315825507913991499019514171327", "204227658261051614813094647512083919101", "270335475701597709356600968192283707928", "41455009785870283809491221383365354832", "169293239471054143244352914876719839193", "209715496126177217885166689802031448886", "124776521846284429917844913909419589065"], "threshold":0.9}, "id":"ASB-A-527035500-d8da8270", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"219480815561105820345550148068414694461", "length":1425}, "id":"ASB-A-527035500-d900547f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/e318064792bb24bed89bc6f10b9ef372cd00d50e", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"updateInputWindows"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["155796206884827581862290594705919952658", "258376708425011540055784706506003999557", "190463034497598129357766158062266265273", "22337772173762286085833662387581230965", "190189954155783960380060441543380672617", "332642691688574217111063064427631775610", "121283967486499349383677047753904849475", "303221094357557600421929831122170490966", "301896271490353770296190580674027387579", "37401843178170364963321369118708025702", "142055367928194779100611511472078757114", "1230587935592434539656609165700564261", "15123631972920053487156663525640308556", "98703169714776422973753199938184122318", "63680734119120047066360396110246234345", "149201177999688568953790755275430478634", "319286328522927019737868094328041970199", "193027717932953653290304402387503672635", "39851372060237890451892885445288139122", "302228880997054128390934844952167022378", "19337811763439585549291717282855770916", "248403770536023356145853180184457508943", "186165088315825507913991499019514171327", "204227658261051614813094647512083919101", "270335475701597709356600968192283707928", "41455009785870283809491221383365354832", "169293239471054143244352914876719839193", "209715496126177217885166689802031448886", "124776521846284429917844913909419589065"], "threshold":0.9}, "id":"ASB-A-527035500-29fe63f9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"144882206472780664119034154537535057841", "length":1339}, "id":"ASB-A-527035500-ae7b61c6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"updateInputWindows"}}, {"deprecated":false, "digest":{"function_hash":"248183603591817373701342695682002415017", "length":1534}, "id":"ASB-A-527035500-c454b36f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b3b18685c1fa4f4fbb12480f214ce8a6bc549cc1", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"accept"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"248183603591817373701342695682002415017", "length":1534}, "id":"ASB-A-527035500-08276dde", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"accept"}}, {"deprecated":false, "digest":{"line_hashes":["155796206884827581862290594705919952658", "258376708425011540055784706506003999557", "190463034497598129357766158062266265273", "22337772173762286085833662387581230965", "190189954155783960380060441543380672617", "332642691688574217111063064427631775610", "121283967486499349383677047753904849475", "303221094357557600421929831122170490966", "301896271490353770296190580674027387579", "37401843178170364963321369118708025702", "142055367928194779100611511472078757114", "1230587935592434539656609165700564261", "15123631972920053487156663525640308556", "98703169714776422973753199938184122318", "63680734119120047066360396110246234345", "149201177999688568953790755275430478634", "319286328522927019737868094328041970199", "193027717932953653290304402387503672635", "39851372060237890451892885445288139122", "302228880997054128390934844952167022378", "19337811763439585549291717282855770916", "248403770536023356145853180184457508943", "186165088315825507913991499019514171327", "204227658261051614813094647512083919101", "270335475701597709356600968192283707928", "41455009785870283809491221383365354832", "169293239471054143244352914876719839193", "209715496126177217885166689802031448886", "124776521846284429917844913909419589065"], "threshold":0.9}, "id":"ASB-A-527035500-66fbfb94", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"144882206472780664119034154537535057841", "length":1339}, "id":"ASB-A-527035500-7d32301f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/24d969e24a850f6879dfe4f7ec69d4433c64d3c9", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"updateInputWindows"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["155796206884827581862290594705919952658", "258376708425011540055784706506003999557", "190463034497598129357766158062266265273", "22337772173762286085833662387581230965", "190189954155783960380060441543380672617", "332642691688574217111063064427631775610", "121283967486499349383677047753904849475", "303221094357557600421929831122170490966", "301896271490353770296190580674027387579", "37401843178170364963321369118708025702", "142055367928194779100611511472078757114", "1230587935592434539656609165700564261", "15123631972920053487156663525640308556", "98703169714776422973753199938184122318", "63680734119120047066360396110246234345", "149201177999688568953790755275430478634", "319286328522927019737868094328041970199", "193027717932953653290304402387503672635", "39851372060237890451892885445288139122", "302228880997054128390934844952167022378", "19337811763439585549291717282855770916", "248403770536023356145853180184457508943", "186165088315825507913991499019514171327", "204227658261051614813094647512083919101", "270335475701597709356600968192283707928", "41455009785870283809491221383365354832", "169293239471054143244352914876719839193", "209715496126177217885166689802031448886", "124776521846284429917844913909419589065"], "threshold":0.9}, "id":"ASB-A-527035500-086cb4fc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"144882206472780664119034154537535057841", "length":1339}, "id":"ASB-A-527035500-22a30625", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"updateInputWindows"}}, {"deprecated":false, "digest":{"function_hash":"248183603591817373701342695682002415017", "length":1534}, "id":"ASB-A-527035500-9f4a1d8f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/93e791a1249c0303b0b59324db325e259bb886d0", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"accept"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["155796206884827581862290594705919952658", "258376708425011540055784706506003999557", "190463034497598129357766158062266265273", "22337772173762286085833662387581230965", "190189954155783960380060441543380672617", "332642691688574217111063064427631775610", "121283967486499349383677047753904849475", "303221094357557600421929831122170490966", "301896271490353770296190580674027387579", "37401843178170364963321369118708025702", "142055367928194779100611511472078757114", "1230587935592434539656609165700564261", "124553947969102158064592103505137299749", "301272396204600008384223290607903337996", "63680734119120047066360396110246234345", "149201177999688568953790755275430478634", "319286328522927019737868094328041970199", "193027717932953653290304402387503672635", "39851372060237890451892885445288139122", "302228880997054128390934844952167022378", "19337811763439585549291717282855770916", "248403770536023356145853180184457508943", "186165088315825507913991499019514171327", "204227658261051614813094647512083919101", "270335475701597709356600968192283707928", "41455009785870283809491221383365354832", "169293239471054143244352914876719839193", "209715496126177217885166689802031448886", "124776521846284429917844913909419589065"], "threshold":0.9}, "id":"ASB-A-527035500-15a4f161", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java"}}, {"deprecated":false, "digest":{"function_hash":"22451502225606759144343886265447794085", "length":2099}, "id":"ASB-A-527035500-71bd43b7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"accept"}}, {"deprecated":false, "digest":{"function_hash":"219480815561105820345550148068414694461", "length":1425}, "id":"ASB-A-527035500-c4d67568", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/98d57eb097571f8d443da7362a98b1a4357e295d", "target":{"file":"services/core/java/com/android/server/wm/InputMonitor.java", "function":"updateInputWindows"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}