CVE-2025-48528 AI-generated analysis

platform/frameworks/base, SystemUI biometrics (BiometricPrompt / AuthContainerView, UDFPS overlay on 16)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Reverts the "Fix biometric prompt appearing above shade" change in SystemUI's AuthContainerView. The BiometricPrompt window moves back from TYPE_APPLICATION_OVERLAY to TYPE_KEYGUARD_DIALOG, and the panel interaction detector is enabled unconditionally again.

Root cause

Commit 93b417adaecdd ("Fix biometric prompt appearing above shade") made two changes in AuthContainerView.java. It switched the WindowManager.LayoutParams used for the BiometricPrompt window from TYPE_KEYGUARD_DIALOG to TYPE_APPLICATION_OVERLAY. It also moved mPanelInteractionDetector.enable(...) in onAttachedToWindow under if (!constraintBp()), so with constraintBp on the prompt no longer dismissed itself on panel interaction. TYPE_APPLICATION_OVERLAY is the window type available to apps holding SYSTEM_ALERT_WINDOW, while TYPE_KEYGUARD_DIALOG is a system-only type (general platform knowledge). Inference from the diff: the overlay window type is the security-relevant change. The bulletin only rates the issue as High EoP.

How the fix works

• Android 15 (ca71b9a63c40, a pure revert of 93b417adaecdd): in AuthContainerView.java, the new WindowManager.LayoutParams(...) (around line 984) changes the window type from TYPE_APPLICATION_OVERLAY back to TYPE_KEYGUARD_DIALOG. SYSTEM_FLAG_SHOW_FOR_ALL_USERS is unchanged.
• Android 15: AuthContainerView.java:onAttachedToWindow moves mPanelInteractionDetector.enable(() -> animateAway(AuthDialogCallback.DISMISSED_USER_CANCELED)) out of the if (!constraintBp()) block to immediately after mWakefulnessLifecycle.addObserver(this). Only updatePositionByCapability(false) remains flag-gated.
• Android 16 (c2774dc575e9 "Move BP window to Keyguard_dialog"): AuthContainerView.java makes the same TYPE_APPLICATION_OVERLAY -> TYPE_KEYGUARD_DIALOG change. It has no panel detector hunk.
• Android 16: UdfpsControllerOverlay.kt adds a REASON_AUTH_BP branch in show() that binds the touch overlay to the new PromptUdfpsTouchOverlayViewModel (shouldHandleTouches always true). It also drops the controller parameter from show(), and removes the SETTING_REMOVE_ENROLLMENT_UI debug setting and many constructor dependencies. UdfpsController.java now passes Lazy<PromptUdfpsTouchOverlayViewModel> and calls overlay.show(mOverlayParams). UdfpsControllerTest.java and UdfpsControllerOverlayTest.kt are adjusted to match.

Completeness

• Both branches change the single window-type constant in AuthContainerView. No other window creation sites are touched in the provided diffs.
• Android 15 also restores the unconditional mPanelInteractionDetector.enable(). Android 16's diff has no equivalent hunk, so the material does not show whether 16 ever had the flag-gated detector.
• Android 16 goes further than 15: it gives the UDFPS touch overlay a dedicated PromptUdfpsTouchOverlayViewModel for REASON_AUTH_BP. The 15 commit does not include this part.
• The revert on 15 brings back whatever issue 93b417adaecdd was addressing (prompt appearing above the shade). The 15 commit contains no alternative fix for it.

Behavior changes

• The BiometricPrompt window is created as TYPE_KEYGUARD_DIALOG instead of TYPE_APPLICATION_OVERLAY. Given the reverted commit's title, the prompt may again appear above the notification shade on Android 15.
• On Android 15, panel interaction while the prompt is showing dismisses it with AuthDialogCallback.DISMISSED_USER_CANCELED, even when constraintBp() is enabled.
• On Android 16, the UDFPS touch overlay for REASON_AUTH_BP always handles touches (PromptUdfpsTouchOverlayViewModel). The debug-only SETTING_REMOVE_ENROLLMENT_UI setting is removed, and the UdfpsControllerOverlay.show() signature changes.

Per major

• Android 14: Not affected per the bulletin. At android-security-14.0.0_r29, 3/8 lines of the patched region are present.
• Android 15: Resolved in android-security-15.0.0_r10 by ca71b9a63c40, which reverts 93b417adaecdd. At android-security-15.0.0_r17, 8/8 lines of the patched region are present, and the excerpt shows the unconditional mPanelInteractionDetector.enable() in onAttachedToWindow.
• Android 16: Resolved in android-security-16.0.0_r1 by a forward fix (c2774dc575e9). It changes the window type to TYPE_KEYGUARD_DIALOG and refactors UdfpsControllerOverlay/UdfpsController with PromptUdfpsTouchOverlayViewModel. At android-security-16.0.0_r8, 8/8 lines are present.
• Android 17: Not affected per the bulletin. At android-security-17.0.0_r1, 1/8 lines of the patched region are present. The material does not show why.

Unknowns

• The concrete attack scenario, what triggers it, and which privilege is gained. The bulletin only says High EoP.
• Whether Android 16 ever carried the flag-gated mPanelInteractionDetector.enable() regression, since its diff has no such hunk.
• Whether another change on Android 15 addresses the 'prompt appearing above shade' issue after the revert.
• How Android 14 and 17 create the prompt window. Only partial line matches (3/8 and 1/8) are known.

Back to September 2025 · Findings