{"id":"ASB-A-331730488","details":"In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the default IME due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-331730488","CVE-2025-26450"],"modified":"2026-03-11T06:30:08.234470Z","published":"2025-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/f48bf9a2e7c728d7010f8c9ad047fa76a869d3d4"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-06-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-06-01","severity":"High","fixes":["https://googleplex-android.googlesource.com/platform/frameworks/base/+/1a0e562bf1561180c5ce5b159ea8f6e41795a5ec","https://googleplex-android.googlesource.com/platform/frameworks/base/+/d12c5fe88d4d737afea9a57f3f928ed4186737cc","https://googleplex-android.googlesource.com/platform/frameworks/base/+/47414432d61ce79083505ff013372d68eb058fc6"],"vanir_signatures":[{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["253028914726280539825162523973783643965","206739945316017438873574398788485641300","266910084218682548691790128036112675259","185372306841454454408454239359307096468","284494418566078988650496289076205119993","25802988984152440496376130864413880558","200039421099050081133101928042838238067"]},"id":"ASB-A-331730488-0b322e4a","target":{"file":"core/java/android/inputmethodservice/InputMethodService.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/1a0e562bf1561180c5ce5b159ea8f6e41795a5ec","signature_type":"Line"},{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["328651147336952458180860785826680765228","96466046636153201550061560713624272950","77265090412007134642388576780470855016","73737917085226567783077328738629205306","276867639101224459919476091191065327455","147366463899983307002147959728147036","311702867855631226172695613643118024261"]},"id":"ASB-A-331730488-0b6664d8","target":{"file":"core/java/android/inputmethodservice/AbstractInputMethodService.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/1a0e562bf1561180c5ce5b159ea8f6e41795a5ec","signature_type":"Line"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"15227724865056872858497255391329434705","length":246},"id":"ASB-A-331730488-15582c29","target":{"function":"IInputMethodSessionWrapper","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/1a0e562bf1561180c5ce5b159ea8f6e41795a5ec","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"15227724865056872858497255391329434705","length":246},"id":"ASB-A-331730488-2861e4c5","target":{"function":"IInputMethodSessionWrapper","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/47414432d61ce79083505ff013372d68eb058fc6","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["172848984163638007286105947422733921543","847155060487531221374269903456783277","111993470439390836194117260640431436697","104750934806643600617597844639565733695","75158882118009371071361023465821430667","135871466146989901191426208127471819357","308381696451116297295944943316080989956","34927004352094911621456960342404422472","264010978195772620682918915318109148375","257405580271605283524176509605242808267","63841418663469056891104465294179817172","226278951419627437239791060782236326012","57144290942498080497278314675187691415","294291249857791155796089438124406141944","6676187597761962266827575857744206726","277845359819353882831128656289592381607","332188674809392788061235438211348027992","12244925195177707402219998115124248782","14371573940702669578642295716403270786","33527069975899517067426501402678416668","98288309644282461078565607248542740762","225357228333330399650379320798426232389","329357067270808955607109134920522439021","90231326960727631371073822777348269933","172017409234811981036246676321776045885","61947651977670693095880371723143000154","216452831304761845070416103803800894320","176576332023145313246070320348097270531","12869687358214909485317219873106197369","114010758058012026204360729466043416633","180392173072050675894708699977201896479","108587633537507210242609878158511307392"]},"id":"ASB-A-331730488-48023c87","target":{"file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/47414432d61ce79083505ff013372d68eb058fc6","signature_type":"Line"},{"signature_version":"v1","match_only_versions":["16-next"],"target":{"file":"core/java/android/view/inputmethod/InputMethodSession.java"},"deprecated":false,"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["109962503331004009652337911159454565852","92265826247961563126125019730013137549","75563199640304218559070515510244479073","88130024757704395230255689040303933651"]},"id":"ASB-A-331730488-69b5320a","source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/1a0e562bf1561180c5ce5b159ea8f6e41795a5ec"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"61679241690974432802943552968499161217","length":537},"id":"ASB-A-331730488-7d9dce0a","target":{"function":"onInputEvent","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/1a0e562bf1561180c5ce5b159ea8f6e41795a5ec","signature_type":"Function"},{"signature_version":"v1","match_only_versions":["16-next"],"target":{"file":"core/java/android/view/inputmethod/InputMethodSession.java"},"deprecated":false,"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["109962503331004009652337911159454565852","92265826247961563126125019730013137549","75563199640304218559070515510244479073","88130024757704395230255689040303933651"]},"id":"ASB-A-331730488-95b923c1","source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/47414432d61ce79083505ff013372d68eb058fc6"},{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["314805309586719012574927808313753788272","252083341114277273854226940887204903838","4334948302359925559173835269260902851","17766630800612098338813833936091966324","145832304135191506795045817912088579569","44378097996061953417066740617599083435"]},"id":"ASB-A-331730488-b4cfc1ed","target":{"file":"core/java/android/view/inputmethod/InputMethodSession.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/d12c5fe88d4d737afea9a57f3f928ed4186737cc","signature_type":"Line"},{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["253028914726280539825162523973783643965","206739945316017438873574398788485641300","266910084218682548691790128036112675259","185372306841454454408454239359307096468","284494418566078988650496289076205119993","25802988984152440496376130864413880558","200039421099050081133101928042838238067"]},"id":"ASB-A-331730488-c126f219","target":{"file":"core/java/android/inputmethodservice/InputMethodService.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/47414432d61ce79083505ff013372d68eb058fc6","signature_type":"Line"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"61679241690974432802943552968499161217","length":537},"id":"ASB-A-331730488-c5bd6f06","target":{"function":"onInputEvent","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/47414432d61ce79083505ff013372d68eb058fc6","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["172848984163638007286105947422733921543","847155060487531221374269903456783277","111993470439390836194117260640431436697","104750934806643600617597844639565733695","75158882118009371071361023465821430667","135871466146989901191426208127471819357","308381696451116297295944943316080989956","34927004352094911621456960342404422472","264010978195772620682918915318109148375","257405580271605283524176509605242808267","63841418663469056891104465294179817172","226278951419627437239791060782236326012","57144290942498080497278314675187691415","294291249857791155796089438124406141944","6676187597761962266827575857744206726","277845359819353882831128656289592381607","332188674809392788061235438211348027992","12244925195177707402219998115124248782","14371573940702669578642295716403270786","33527069975899517067426501402678416668","98288309644282461078565607248542740762","225357228333330399650379320798426232389","329357067270808955607109134920522439021","90231326960727631371073822777348269933","172017409234811981036246676321776045885","61947651977670693095880371723143000154","216452831304761845070416103803800894320","176576332023145313246070320348097270531","12869687358214909485317219873106197369","114010758058012026204360729466043416633","180392173072050675894708699977201896479","108587633537507210242609878158511307392"]},"id":"ASB-A-331730488-f0a227d0","target":{"file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/1a0e562bf1561180c5ce5b159ea8f6e41795a5ec","signature_type":"Line"},{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["328651147336952458180860785826680765228","96466046636153201550061560713624272950","77265090412007134642388576780470855016","73737917085226567783077328738629205306","276867639101224459919476091191065327455","147366463899983307002147959728147036","311702867855631226172695613643118024261"]},"id":"ASB-A-331730488-f8af89dd","target":{"file":"core/java/android/inputmethodservice/AbstractInputMethodService.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/47414432d61ce79083505ff013372d68eb058fc6","signature_type":"Line"}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/ASB-A-331730488.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-06-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-06-01","severity":"High","fixes":["https://googleplex-android.googlesource.com/platform/frameworks/base/+/9fe5a77f7a48f891e87898b7a97361c6355c0dcd"],"vanir_signatures":[{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"15227724865056872858497255391329434705","length":246},"id":"ASB-A-331730488-910d8695","target":{"function":"IInputMethodSessionWrapper","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/9fe5a77f7a48f891e87898b7a97361c6355c0dcd","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"61679241690974432802943552968499161217","length":537},"id":"ASB-A-331730488-f6c31aa8","target":{"function":"onInputEvent","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/9fe5a77f7a48f891e87898b7a97361c6355c0dcd","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["172848984163638007286105947422733921543","847155060487531221374269903456783277","111993470439390836194117260640431436697","104750934806643600617597844639565733695","75158882118009371071361023465821430667","135871466146989901191426208127471819357","308381696451116297295944943316080989956","34927004352094911621456960342404422472","264010978195772620682918915318109148375","257405580271605283524176509605242808267","63841418663469056891104465294179817172","226278951419627437239791060782236326012","57144290942498080497278314675187691415","294291249857791155796089438124406141944","6676187597761962266827575857744206726","277845359819353882831128656289592381607","332188674809392788061235438211348027992","12244925195177707402219998115124248782","14371573940702669578642295716403270786","33527069975899517067426501402678416668","98288309644282461078565607248542740762","225357228333330399650379320798426232389","329357067270808955607109134920522439021","90231326960727631371073822777348269933","172017409234811981036246676321776045885","61947651977670693095880371723143000154","216452831304761845070416103803800894320","176576332023145313246070320348097270531","12869687358214909485317219873106197369","114010758058012026204360729466043416633","180392173072050675894708699977201896479","108587633537507210242609878158511307392"]},"id":"ASB-A-331730488-fa8cbc95","target":{"file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/9fe5a77f7a48f891e87898b7a97361c6355c0dcd","signature_type":"Line"}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/ASB-A-331730488.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-06-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-06-01","severity":"High","fixes":["https://googleplex-android.googlesource.com/platform/frameworks/base/+/ca6ddbf971648d2661e3f6f9d3578731bf415ce6"],"vanir_signatures":[{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"61679241690974432802943552968499161217","length":537},"id":"ASB-A-331730488-55a9c14a","target":{"function":"onInputEvent","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/ca6ddbf971648d2661e3f6f9d3578731bf415ce6","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["172848984163638007286105947422733921543","847155060487531221374269903456783277","111993470439390836194117260640431436697","104750934806643600617597844639565733695","75158882118009371071361023465821430667","135871466146989901191426208127471819357","308381696451116297295944943316080989956","115734396422696501703881965738501981506","117539816710689564457895376510853699701","174907999354117090166763143319437809499","63841418663469056891104465294179817172","226278951419627437239791060782236326012","57144290942498080497278314675187691415","294291249857791155796089438124406141944","6676187597761962266827575857744206726","277845359819353882831128656289592381607","332188674809392788061235438211348027992","12244925195177707402219998115124248782","14371573940702669578642295716403270786","33527069975899517067426501402678416668","98288309644282461078565607248542740762","225357228333330399650379320798426232389","329357067270808955607109134920522439021","90231326960727631371073822777348269933","172017409234811981036246676321776045885","61947651977670693095880371723143000154","216452831304761845070416103803800894320","176576332023145313246070320348097270531","12869687358214909485317219873106197369","114010758058012026204360729466043416633","180392173072050675894708699977201896479","108587633537507210242609878158511307392"]},"id":"ASB-A-331730488-8b70c54d","target":{"file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/ca6ddbf971648d2661e3f6f9d3578731bf415ce6","signature_type":"Line"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"15227724865056872858497255391329434705","length":246},"id":"ASB-A-331730488-bbb82584","target":{"function":"IInputMethodSessionWrapper","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/ca6ddbf971648d2661e3f6f9d3578731bf415ce6","signature_type":"Function"}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/ASB-A-331730488.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-06-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-06-01","severity":"High","fixes":["https://googleplex-android.googlesource.com/platform/frameworks/base/+/c65e5458f5a3c06342d177d1ba1cc03c42323a94"],"vanir_signatures":[{"deprecated":false,"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["172848984163638007286105947422733921543","847155060487531221374269903456783277","111993470439390836194117260640431436697","104750934806643600617597844639565733695","75158882118009371071361023465821430667","135871466146989901191426208127471819357","308381696451116297295944943316080989956","34927004352094911621456960342404422472","264010978195772620682918915318109148375","257405580271605283524176509605242808267","63841418663469056891104465294179817172","226278951419627437239791060782236326012","57144290942498080497278314675187691415","294291249857791155796089438124406141944","6676187597761962266827575857744206726","277845359819353882831128656289592381607","332188674809392788061235438211348027992","12244925195177707402219998115124248782","14371573940702669578642295716403270786","33527069975899517067426501402678416668","98288309644282461078565607248542740762","225357228333330399650379320798426232389","329357067270808955607109134920522439021","90231326960727631371073822777348269933","172017409234811981036246676321776045885","61947651977670693095880371723143000154","216452831304761845070416103803800894320","176576332023145313246070320348097270531","12869687358214909485317219873106197369","114010758058012026204360729466043416633","180392173072050675894708699977201896479","108587633537507210242609878158511307392"]},"id":"ASB-A-331730488-0ff58d6a","target":{"file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/c65e5458f5a3c06342d177d1ba1cc03c42323a94","signature_type":"Line"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"15227724865056872858497255391329434705","length":246},"id":"ASB-A-331730488-a7740e8e","target":{"function":"IInputMethodSessionWrapper","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/c65e5458f5a3c06342d177d1ba1cc03c42323a94","signature_type":"Function"},{"deprecated":false,"signature_version":"v1","digest":{"function_hash":"61679241690974432802943552968499161217","length":537},"id":"ASB-A-331730488-fb98c4db","target":{"function":"onInputEvent","file":"core/java/android/inputmethodservice/IInputMethodSessionWrapper.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/c65e5458f5a3c06342d177d1ba1cc03c42323a94","signature_type":"Function"}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/ASB-A-331730488.json"}}],"schema_version":"1.7.5"}