{"id":"ASB-A-527038637", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58934", "A-527038637"], "details":"In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/adc9ad6a28520b2e48d9bb8f886cc7eb602485ec"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"111583122706557595446516432267511747009", "length":1266}, "id":"ASB-A-527038637-3b9ee4b3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/adc9ad6a28520b2e48d9bb8f886cc7eb602485ec", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"prepareWindowToDisplayDuringRelayout"}}, {"deprecated":false, "digest":{"line_hashes":["172316532480260566771316135480817064860", "229943414542373682695838821745334649417", "290428625613526792657451817326184781708", "324620822996435013849191408013256154006"], "threshold":0.9}, "id":"ASB-A-527038637-7b0c2d27", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/adc9ad6a28520b2e48d9bb8f886cc7eb602485ec", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0d805b6d75ae461f14fb2c2fdf2a2f226b3749f8"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"262135068018698350543515490589013414421", "length":1238}, "id":"ASB-A-527038637-4a4a7f5b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0d805b6d75ae461f14fb2c2fdf2a2f226b3749f8", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"prepareWindowToDisplayDuringRelayout"}}, {"deprecated":false, "digest":{"line_hashes":["172316532480260566771316135480817064860", "229943414542373682695838821745334649417", "290428625613526792657451817326184781708", "199946545686417349082869790978587771905"], "threshold":0.9}, "id":"ASB-A-527038637-75932bb2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/0d805b6d75ae461f14fb2c2fdf2a2f226b3749f8", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/416bf6c4e4abfa9c3c606c6aa33c4844443e97aa"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"111583122706557595446516432267511747009", "length":1266}, "id":"ASB-A-527038637-981f6c18", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/416bf6c4e4abfa9c3c606c6aa33c4844443e97aa", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"prepareWindowToDisplayDuringRelayout"}}, {"deprecated":false, "digest":{"line_hashes":["172316532480260566771316135480817064860", "229943414542373682695838821745334649417", "290428625613526792657451817326184781708", "324620822996435013849191408013256154006"], "threshold":0.9}, "id":"ASB-A-527038637-e3bbe6f3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/416bf6c4e4abfa9c3c606c6aa33c4844443e97aa", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b852566e1601428469e1def048569f8934fb97d8"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["172316532480260566771316135480817064860", "229943414542373682695838821745334649417", "290428625613526792657451817326184781708", "324620822996435013849191408013256154006"], "threshold":0.9}, "id":"ASB-A-527038637-11b1d51c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b852566e1601428469e1def048569f8934fb97d8", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"111583122706557595446516432267511747009", "length":1266}, "id":"ASB-A-527038637-42403088", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b852566e1601428469e1def048569f8934fb97d8", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"prepareWindowToDisplayDuringRelayout"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cbe4bd259f21360d97331846e00ef2b9d3049953"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["172316532480260566771316135480817064860", "229943414542373682695838821745334649417", "290428625613526792657451817326184781708", "324620822996435013849191408013256154006"], "threshold":0.9}, "id":"ASB-A-527038637-0a387799", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cbe4bd259f21360d97331846e00ef2b9d3049953", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"111583122706557595446516432267511747009", "length":1266}, "id":"ASB-A-527038637-2cfb69e3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/cbe4bd259f21360d97331846e00ef2b9d3049953", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"prepareWindowToDisplayDuringRelayout"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b069a8fc7b38e646598a31f75228172b6463f0a1"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["172316532480260566771316135480817064860", "229943414542373682695838821745334649417", "290428625613526792657451817326184781708", "236434643719041100710621819007992052237"], "threshold":0.9}, "id":"ASB-A-527038637-0e67786e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b069a8fc7b38e646598a31f75228172b6463f0a1", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java"}}, {"deprecated":false, "digest":{"function_hash":"128636909567675826003388939581272502992", "length":1226}, "id":"ASB-A-527038637-d130c7b5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/b069a8fc7b38e646598a31f75228172b6463f0a1", "target":{"file":"services/core/java/com/android/server/wm/WindowState.java", "function":"prepareWindowToDisplayDuringRelayout"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}