CVE-2025-26428 AI-generated analysis

platform/frameworks/base, WindowManager lock task / screen pinning (services/core/java/com/android/server/wm/LockTaskController.java)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Adds an early return in LockTaskController.startLockTaskMode so that an app-initiated request on a LOCK_TASK_AUTH_PINNABLE task that is already in mLockTaskModeTasks no longer triggers a new screen pinning request via StatusBarManagerInternal.showScreenPinningRequest.

Root cause

In LockTaskController.startLockTaskMode, when isSystemCaller is false and task.mLockTaskAuth == LOCK_TASK_AUTH_PINNABLE (app not in the lock task allowlist), the code unconditionally called StatusBarManagerInternal.showScreenPinningRequest(task.mTaskId) to ask the user to pin the app. It did not check whether the task was already locked (already present in mLockTaskModeTasks, e.g. after the system had pinned it with isSystemCaller true). An app whose task was already pinned could therefore cause the system pinning request UI to be shown again. The bulletin rates this as a High severity EoP; the material does not describe the concrete consequence further.

How the fix works

• services/core/java/com/android/server/wm/LockTaskController.java:startLockTaskMode: inside the `!isSystemCaller` block, in the `task.mLockTaskAuth == LOCK_TASK_AUTH_PINNABLE` branch, a new guard `if (mLockTaskModeTasks.contains(task)) { Slog.i(TAG_LOCKTASK, "Already locked."); return; }` is inserted before the existing ProtoLog and the StatusBarManagerInternal.showScreenPinningRequest(task.mTaskId) call. If the task is already in lock task mode, the method returns without showing a pinning request.
• services/tests/wmtests/src/com/android/server/wm/LockTaskControllerTest.java:testStartLockTaskMode_pinnedBySystem: extended so that after the system pins the task, an app call `startLockTaskMode(tr, false, TEST_UID)` is verified to never invoke mStatusBarManagerInternal.showScreenPinningRequest(anyInt()).

Completeness

• Covers the app-caller (isSystemCaller == false) path for tasks with LOCK_TASK_AUTH_PINNABLE, which is the only place in startLockTaskMode that calls showScreenPinningRequest; other callers outside this method are not shown.
• The guard checks only whether the same Task object is in mLockTaskModeTasks; a request for a different PINNABLE task while another task is locked is not affected by this change (the code still proceeds to showScreenPinningRequest in that case). Whether that matters is not shown by the material.
• The `task.mLockTaskUid = callingUid;` assignment still executes before the new check, so mLockTaskUid is updated even when the request is rejected as already locked.
• The allowlisted branch (`else if (mLockTaskModeState == LOCK_TASK_MODE_PINNED)` -> stopLockTaskMode then setLockTaskMode) and the isSystemCaller path are untouched by this fix.

Behavior changes

• An app calling startLockTask on its already-locked PINNABLE task no longer causes the system UI pinning request to be displayed; the call becomes a no-op logged at info level with TAG_LOCKTASK "Already locked.".
• No new exception or error is returned to the caller; the method simply returns.

Per major

• Android 14: same fix: platform/frameworks/base d4cd532ad022 in android-security-14.0.0_r20 (Change-Id Ic5d2125d39e5e98301d79c8f5aa8986a44e06794); at android-security-14.0.0_r29 all 8/8 patched lines are present.
• Android 15: same fix: platform/frameworks/base afd05dc17e02 in android-security-15.0.0_r8, identical diff (same hunk, same test change); at android-security-15.0.0_r17 8/8 lines present.
• Android 16: not affected per the bulletin (not listed); at android-security-16.0.0_r8 the patched region is present (8/8 lines).
• Android 17: not affected per the bulletin (not listed); at android-security-17.0.0_r1 7/8 lines of the patched region are present; which line differs is not shown.

Unknowns

• The material does not show the concrete security impact behind the High/EoP rating (what repeated pinning requests enable).
• The material does not show the binder entry point or permission checks between an app's startLockTask() call and LockTaskController.startLockTaskMode.
• The exact one-line difference in the patched region at android-security-17.0.0_r1 is not shown.
• Whether TAG_LOCKTASK is available in LockTaskController on older branches is not shown.

Back to May 2025 · Findings