{
 "month": "2025-11",
 "generated": "2026-10-06T12:05+00:00",
 "majors": {
  "14": {
   "counts": {
    "announced": 1,
    "certain": 1,
    "probable": 0,
    "not_published": 0,
    "not_covered": 0,
    "awaiting": 0
   },
   "advisories": [
    {
     "cve": "CVE-2025-48593",
     "osv_id": "ASB-A-374746961",
     "source": "osv",
     "announced": "2025-11-01",
     "severity": "Critical",
     "types": [
      "RCE"
     ],
     "status": "resolved",
     "brief": {
      "summary": "bta_hf_client_cb_init now cancels any outstanding SDP service search and frees the HF client's discovery database (p_disc_db) before the control block is zeroed, instead of silently dropping the pointer.",
      "confidence": "medium",
      "backport_notes": [
       "Match the branch's SDP API style: direct SDP_CancelServiceSearch with APPL_TRACE_WARNING as in the 14 commit, or get_legacy_stack_sdp_api()->service.SDP_CancelServiceSearch with log::warn as in the 15/16 commits. The 14 commit also adds test stubs to bta_dip_test.cc and bta_hf_client_add_record_test.cc.",
       "The commit message calls the earlier flag-guarded b/291281168 changes partial. Check which related discovery-database checks (e.g. those in bta_hf_client_do_disc and process_service_search_attr_rsp seen in the Android 16 commit) are present on the target branch."
      ],
      "meta": {
       "generated": "2026-10-03",
       "author_model": "claude-fable-5-1",
       "review_model": "claude-opus-5-5",
       "review_corrections": 7,
       "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
      }
     },
     "method": [
      "bug_id"
     ],
     "confidence": "certain",
     "first_fix": {
      "tag": "android-security-14.0.0_r23",
      "date": "2025-11-03",
      "provenance": "security_tag"
     },
     "last_fix": {
      "tag": "android-security-14.0.0_r23",
      "date": "2025-11-03",
      "provenance": "security_tag"
     },
     "public_commits": [
      {
       "project": "platform/packages/modules/Bluetooth",
       "sha": "75ecc79c24e076d7e15a5470a90df99d05c6186e",
       "tag": "android-security-14.0.0_r23",
       "provenance": "security_tag",
       "method": "bug_id",
       "confidence": "certain",
       "evidence": null,
       "similarity": null
      }
     ],
     "n_public_commits": 1,
     "projects": [
      "platform/packages/modules/Bluetooth"
     ]
    }
   ],
   "tags": [
    "android-security-14.0.0_r23"
   ],
   "unannounced": [
    {
     "bug_ids": [
      "395168279"
     ],
     "commits": [
      {
       "project": "platform/frameworks/base",
       "sha": "da672983c056ab1daad5c91b6e372c019919d546",
       "subject": "Handle exceptions from querying appinfo in RemoteViews#addAppWidget.",
       "tag": "android-security-14.0.0_r23",
       "merged": "2025-07-28",
       "markers": []
      }
     ],
     "tags": [
      "android-security-14.0.0_r23"
     ],
     "tag": "android-security-14.0.0_r23"
    }
   ],
   "coverage": {
    "n_ingested_tags": 30,
    "first_ingested_tag": "android-security-14.0.0_r1",
    "latest_ingested_tag": "android-security-14.0.0_r30",
    "window_base_tag": "android-14.0.0_r1",
    "window_start": "2023-10-04",
    "partial_tags": []
   },
   "platform_update_tags": {},
   "briefs": {
    "CVE-2025-48593": {
     "cve": "CVE-2025-48593",
     "summary": "bta_hf_client_cb_init now cancels any outstanding SDP service search and frees the HF client's discovery database (p_disc_db) before the control block is zeroed, instead of silently dropping the pointer.",
     "component": "platform/packages/modules/Bluetooth, system/bta/hf_client (HFP hands-free client, SDP discovery)",
     "weakness": "Use-after-free / dangling pointer of the HF client SDP discovery database (lifetime handling of p_disc_db)",
     "root_cause": "In system/bta/hf_client/bta_hf_client_main.cc, bta_hf_client_cb_init released the collision timer and the hf_indicators containers and then reset the whole control block with `*client_cb = {}`, without handling client_cb->p_disc_db. If a discovery database was allocated and an SDP search was outstanding, the reset discarded the pointer without cancelling the search or freeing the database. A comment in the Android 16 code (bta_hf_client_do_disc) says a preexisting discovery database can lead to a race and a UAF once the connection is closed. The Android 14 commit message says the earlier flag-guarded changes for b/291281168 only partly resolved the issue and that a check was needed at this additional location.",
     "fix_analysis": [
      "system/bta/hf_client/bta_hf_client_main.cc:bta_hf_client_cb_init: before `*client_cb = {}`, if client_cb->p_disc_db is non-null, call SDP_CancelServiceSearch(client_cb->p_disc_db) (logging APPL_TRACE_WARNING with the peer address if cancellation fails) and then osi_free_and_reset((void**)&client_cb->p_disc_db).",
      "system/bta/test/bta_dip_test.cc (which includes stack/sdp/sdp_api.cc): adds stubs for sdpu_find_ccb_by_db and sdp_disconnect.",
      "system/bta/test/bta_hf_client_add_record_test.cc: adds a stub SDP_CancelServiceSearch that returns false.",
      "Android 16 counterpart (5ed63461b441): removes the aconfig flag btsec_check_valid_discovery_database. This makes three checks unconditional: the p_disc_db check in bta_hf_client_cb_init, the preexisting-database check in bta_hf_client_sdp.cc:bta_hf_client_do_disc, and the NULL p_db check in sdp_discovery.cc:process_service_search_attr_rsp."
     ],
     "completeness": [
      "Covers every reinitialisation of an HF client control block through bta_hf_client_cb_init, including bta_hf_client_cb_arr_init per index search.",
      "On Android 14 and 15 the commit changes only bta_hf_client_cb_init. The two other checks visible in the Android 16 commit (bta_hf_client_do_disc and process_service_search_attr_rsp, flag bug 356201480) are not in the 14/15 diffs. The material does not show whether they exist on those branches, or whether they are the b/291281168 changes the commit message refers to.",
      "If SDP_CancelServiceSearch returns false, the code only logs a warning and still frees p_disc_db. The material does not show what state the SDP layer is left in on that path.",
      "Other code paths that may free or replace p_disc_db outside bta_hf_client_cb_init are not shown and are not changed by this commit."
     ],
     "behavior_changes": [
      "Reinitialising an HF client control block now cancels a pending SDP service search on its discovery database and frees that database. A warning is logged if cancellation fails.",
      "Android 16 only: behaviours that were behind btsec_check_valid_discovery_database are now always on. bta_hf_client_do_disc logs an error and resets p_disc_db when a discovery database already exists. process_service_search_attr_rsp logs a warning when there is no discovery database."
     ],
     "preconditions": [
      "HFP hands-free client (HF role) in use in the Bluetooth stack (system/bta/hf_client).",
      "An HF client control block with a non-null p_disc_db is reinitialised through bta_hf_client_cb_init. bta_hf_client_cb_arr_init is a caller per index search; other callers are not shown.",
      "Interaction with a remote peer over Bluetooth. The bulletin rates this Critical RCE, but the trigger sequence is not shown in the material."
     ],
     "per_major": {
      "14": "same fix: commit 75ecc79c24e0 in android-security-14.0.0_r23 adds the p_disc_db cancel-and-free block to bta_hf_client_cb_init (direct SDP_CancelServiceSearch, APPL_TRACE_WARNING), plus test stubs. 8/8 lines present at r29.",
      "15": "adapted fix: commit c69c78d7c4f6 in android-security-15.0.0_r11. Same logic, but it calls get_legacy_stack_sdp_api()->service.SDP_CancelServiceSearch and uses log::warn. 5/5 lines present at r17.",
      "16": "adapted fix: the check already existed behind the aconfig flag btsec_check_valid_discovery_database. Commit 5ed63461b441 in android-security-16.0.0_r2 (resolver matched by change_id) makes the checks in bta_hf_client_cb_init, bta_hf_client_do_disc and process_service_search_attr_rsp unconditional, and deletes the flag from flags/security.aconfig. 5/8 lines of the patched region present at r8.",
      "17": "not affected (not listed by the bulletin); patched region present (8/8) at android-security-17.0.0_r1."
     },
     "backport_notes": [
      "Match the branch's SDP API style: direct SDP_CancelServiceSearch with APPL_TRACE_WARNING as in the 14 commit, or get_legacy_stack_sdp_api()->service.SDP_CancelServiceSearch with log::warn as in the 15/16 commits. The 14 commit also adds test stubs to bta_dip_test.cc and bta_hf_client_add_record_test.cc.",
      "The commit message calls the earlier flag-guarded b/291281168 changes partial. Check which related discovery-database checks (e.g. those in bta_hf_client_do_disc and process_service_search_attr_rsp seen in the Android 16 commit) are present on the target branch."
     ],
     "confidence": "medium",
     "unknowns": [
      "The exact sequence by which a control block with a live p_disc_db reaches bta_hf_client_cb_init (callers other than bta_hf_client_cb_arr_init are not shown).",
      "Whether the flag-guarded checks in bta_hf_client_do_disc and process_service_search_attr_rsp exist on the Android 14 and 15 security branches, and whether they are the b/291281168 changes.",
      "What SDP_CancelServiceSearch does, including on failure, and whether the SDP layer could still reference the freed database.",
      "Why the Android 16 patched-region match is 5/8 at android-security-16.0.0_r8."
     ],
     "meta": {
      "generated": "2026-10-03",
      "author_model": "claude-fable-5-1",
      "review_model": "claude-opus-5-5",
      "review_corrections": 7,
      "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
     }
    }
   }
  },
  "15": {
   "counts": {
    "announced": 1,
    "certain": 1,
    "probable": 0,
    "not_published": 0,
    "not_covered": 0,
    "awaiting": 0
   },
   "advisories": [
    {
     "cve": "CVE-2025-48593",
     "osv_id": "ASB-A-374746961",
     "source": "osv",
     "announced": "2025-11-01",
     "severity": "Critical",
     "types": [
      "RCE"
     ],
     "status": "resolved",
     "brief": {
      "summary": "bta_hf_client_cb_init in the Bluetooth HF client now cancels any pending SDP service search and frees a still-present discovery database (p_disc_db) before the control block is zeroed, instead of silently dropping the pointer.",
      "confidence": "medium",
      "backport_notes": [
       "For trees without the get_legacy_stack_sdp_api() wrapper and log:: macros (Android 14 style), use the direct SDP_CancelServiceSearch() call and APPL_TRACE_WARNING as in 75ecc79c24e0. Also add the SDP stubs to bta_dip_test.cc and bta_hf_client_add_record_test.cc so the BTA unit tests still link.",
       "If the tree carries the flagged btsec_check_valid_discovery_database variant (as Android 16 did), consider removing the flag condition in all three locations (bta_hf_client_cb_init, bta_hf_client_do_disc, process_service_search_attr_rsp) as Google did, rather than adding a duplicate check."
      ],
      "meta": {
       "generated": "2026-10-03",
       "author_model": "claude-fable-5-1",
       "review_model": "claude-opus-5-5",
       "review_corrections": 4,
       "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
      }
     },
     "method": [
      "bug_id"
     ],
     "confidence": "certain",
     "first_fix": {
      "tag": "android-security-15.0.0_r11",
      "date": "2025-11-03",
      "provenance": "security_tag"
     },
     "last_fix": {
      "tag": "android-security-15.0.0_r11",
      "date": "2025-11-03",
      "provenance": "security_tag"
     },
     "public_commits": [
      {
       "project": "platform/packages/modules/Bluetooth",
       "sha": "c69c78d7c4f623201f35831d32e6c401156e76cc",
       "tag": "android-security-15.0.0_r11",
       "provenance": "security_tag",
       "method": "bug_id",
       "confidence": "certain",
       "evidence": null,
       "similarity": null
      }
     ],
     "n_public_commits": 1,
     "projects": [
      "platform/packages/modules/Bluetooth"
     ]
    }
   ],
   "tags": [
    "android-security-15.0.0_r11"
   ],
   "unannounced": [
    {
     "bug_ids": [
      "395168279"
     ],
     "commits": [
      {
       "project": "platform/frameworks/base",
       "sha": "f1b1bce4734f71613f5aac680d326aca3d8b6766",
       "subject": "Handle exceptions from querying appinfo in RemoteViews#addAppWidget.",
       "tag": "android-security-15.0.0_r11",
       "merged": "2025-07-28",
       "markers": []
      }
     ],
     "tags": [
      "android-security-15.0.0_r11"
     ],
     "tag": "android-security-15.0.0_r11"
    }
   ],
   "coverage": {
    "n_ingested_tags": 18,
    "first_ingested_tag": "android-security-15.0.0_r1",
    "latest_ingested_tag": "android-security-15.0.0_r18",
    "window_base_tag": "android-15.0.0_r1",
    "window_start": "2024-09-03",
    "partial_tags": []
   },
   "platform_update_tags": {},
   "briefs": {
    "CVE-2025-48593": {
     "cve": "CVE-2025-48593",
     "summary": "bta_hf_client_cb_init in the Bluetooth HF client now cancels any pending SDP service search and frees a still-present discovery database (p_disc_db) before the control block is zeroed, instead of silently dropping the pointer.",
     "component": "platform/packages/modules/Bluetooth, system/bta/hf_client (Hands-Free client, SDP discovery database handling)",
     "weakness": "Use-after-free / stale pointer to the HF client SDP discovery database (per the comment in the related Android 16 change in bta_hf_client_do_disc: \"race condition leading to UAF once this connection is closed\")",
     "root_cause": "bta_hf_client_cb_init resets a tBTA_HF_CLIENT_CB with `*client_cb = {}` after explicitly releasing only collision_timer and the hf_indicators containers. If the control block still held a discovery database (client_cb->p_disc_db), the pointer was wiped without cancelling the associated SDP service search or freeing the buffer, leaving the SDP layer with a database the HF client no longer tracked. The commit message says earlier flag-guarded changes for the related issue b/291281168 only partially resolved the issue and a check was needed in this additional location. The exact use-after-free sequence is not shown in the material.",
     "fix_analysis": [
      "system/bta/hf_client/bta_hf_client_main.cc:bta_hf_client_cb_init: before `*client_cb = {}`, if client_cb->p_disc_db is non-null, call get_legacy_stack_sdp_api()->service.SDP_CancelServiceSearch(client_cb->p_disc_db), logging a warning via log::warn with the peer address if cancellation fails. Then call osi_free_and_reset((void**)&client_cb->p_disc_db) to free the database and null the pointer.",
      "The free happens regardless of whether SDP_CancelServiceSearch succeeded. Only a failed cancellation is logged.",
      "On Android 15 the new check is unconditional (no aconfig flag). On Android 16 the same check already existed behind com::android::bluetooth::flags::btsec_check_valid_discovery_database. The resolving commit removed the flag there and in bta_hf_client_sdp.cc:bta_hf_client_do_disc and system/stack/sdp/sdp_discovery.cc:process_service_search_attr_rsp, making all three checks unconditional."
     ],
     "completeness": [
      "Covers the control-block re-initialization path (bta_hf_client_cb_init, called at least from bta_hf_client_cb_arr_init for every slot) whenever a discovery database is still attached.",
      "This Android 15 commit touches only bta_hf_client_cb_init. The companion checks seen on Android 16 (bta_hf_client_do_disc rejecting a preexisting p_disc_db, process_service_search_attr_rsp rejecting a NULL p_ccb->p_db) are not part of this diff. The material does not show whether they are present, or unflagged, on the 15 and 14 branches.",
      "If SDP_CancelServiceSearch fails, the code still frees the database and only logs a warning. What SDP state remains after a failed cancellation is not shown."
     ],
     "behavior_changes": [
      "A pending HF client SDP service search is cancelled when its control block is re-initialized with a discovery database still attached.",
      "New log::warn message 'Unable to cancel SDP service discovery peer:{}' when cancellation fails.",
      "The discovery database buffer is now freed on re-init instead of being orphaned."
     ],
     "preconditions": [
      "The device acts as an HFP Hands-Free client (BTA HF client enabled) and has started SDP discovery toward a peer, so client_cb->p_disc_db is allocated.",
      "bta_hf_client_cb_init runs on that control block while the discovery database is still present. The material shows bta_hf_client_cb_arr_init as a caller; other callers are not shown.",
      "The bulletin rates it Critical RCE. The exact trigger sequence is not shown."
     ],
     "per_major": {
      "14": "adapted fix: commit 75ecc79c24e0 in android-security-14.0.0_r23 adds the same p_disc_db check to bta_hf_client_cb_init using the direct SDP_CancelServiceSearch() call and APPL_TRACE_WARNING. It also adds test stubs (sdpu_find_ccb_by_db and sdp_disconnect in bta_dip_test.cc; SDP_CancelServiceSearch in bta_hf_client_add_record_test.cc). 8/8 lines present at android-security-14.0.0_r29.",
      "15": "this fix: commit c69c78d7c4f6 in android-security-15.0.0_r11, an unflagged check in bta_hf_client_cb_init using get_legacy_stack_sdp_api()->service.SDP_CancelServiceSearch and log::warn. 5/5 lines present at android-security-15.0.0_r17.",
      "16": "adapted fix (resolved by change_id): commit 5ed63461b441 in android-security-16.0.0_r2, 'Remove flag btsec_check_valid_discovery_database', makes the already-present flagged check in bta_hf_client_cb_init unconditional. It also removes the flag from the checks in bta_hf_client_do_disc and process_service_search_attr_rsp, and deletes the flag from flags/security.aconfig. 5/8 lines of the patched region present at android-security-16.0.0_r8 (the code differs from the 15 diff).",
      "17": "not affected per the bulletin (not listed); the patched region (5/5 lines) is present at android-security-17.0.0_r1."
     },
     "backport_notes": [
      "For trees without the get_legacy_stack_sdp_api() wrapper and log:: macros (Android 14 style), use the direct SDP_CancelServiceSearch() call and APPL_TRACE_WARNING as in 75ecc79c24e0. Also add the SDP stubs to bta_dip_test.cc and bta_hf_client_add_record_test.cc so the BTA unit tests still link.",
      "If the tree carries the flagged btsec_check_valid_discovery_database variant (as Android 16 did), consider removing the flag condition in all three locations (bta_hf_client_cb_init, bta_hf_client_do_disc, process_service_search_attr_rsp) as Google did, rather than adding a duplicate check."
     ],
     "confidence": "medium",
     "unknowns": [
      "The exact sequence by which a remote peer causes bta_hf_client_cb_init to run with a live p_disc_db, and which freed object is later used.",
      "Whether the Android 14 and 15 branches contain the companion checks in bta_hf_client_do_disc and process_service_search_attr_rsp, and whether they are flag-guarded there.",
      "How b/291281168 relates to the btsec_check_valid_discovery_database flag (aconfig lists bug 356201480).",
      "What SDP_CancelServiceSearch does internally, and what state remains if it fails.",
      "The full list of callers of bta_hf_client_cb_init beyond bta_hf_client_cb_arr_init (index search returned none)."
     ],
     "meta": {
      "generated": "2026-10-03",
      "author_model": "claude-fable-5-1",
      "review_model": "claude-opus-5-5",
      "review_corrections": 4,
      "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
     }
    }
   }
  },
  "16": {
   "counts": {
    "announced": 1,
    "certain": 1,
    "probable": 0,
    "not_published": 0,
    "not_covered": 0,
    "awaiting": 0
   },
   "advisories": [
    {
     "cve": "CVE-2025-48593",
     "osv_id": "ASB-A-374746961",
     "source": "osv",
     "announced": "2025-11-01",
     "severity": "Critical",
     "types": [
      "RCE"
     ],
     "status": "resolved",
     "brief": {
      "summary": "Removes the btsec_check_valid_discovery_database aconfig flag so that the HF client and SDP checks it gated are always active: cancelling and freeing an existing SDP discovery database before an HF client control block is reinitialised, refusing to start discovery when a database already exists, and checking for a missing database in SDP search-attribute response processing.",
      "confidence": "medium",
      "backport_notes": [
       "On branches that contain the flagged checks, apply this commit as-is. On branches without them, port the guards directly without a flag, as was done on 14 and 15, and consider also adding the bta_hf_client_do_disc and process_service_search_attr_rsp guards, which the 14/15 commits shown do not include.",
       "Android 14 uses the direct SDP_CancelServiceSearch()/APPL_TRACE_WARNING API rather than get_legacy_stack_sdp_api()/log::warn. Its fix commit also adds test stubs in bta_dip_test.cc and bta_hf_client_add_record_test.cc."
      ],
      "meta": {
       "generated": "2026-10-02",
       "author_model": "claude-fable-5-1",
       "review_model": "claude-opus-5-5",
       "review_corrections": 6,
       "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
      }
     },
     "method": [
      "change_id"
     ],
     "confidence": "certain",
     "first_fix": {
      "tag": "android-security-16.0.0_r2",
      "date": "2025-11-20",
      "provenance": "security_tag"
     },
     "last_fix": {
      "tag": "android-security-16.0.0_r2",
      "date": "2025-11-20",
      "provenance": "security_tag"
     },
     "public_commits": [
      {
       "project": "platform/packages/modules/Bluetooth",
       "sha": "5ed63461b44198c80d5aff7e1af1df812f782abb",
       "tag": "android-security-16.0.0_r2",
       "provenance": "security_tag",
       "method": "change_id",
       "confidence": "certain",
       "evidence": "ref 5ed63461b441",
       "similarity": null
      }
     ],
     "n_public_commits": 1,
     "projects": [
      "platform/packages/modules/Bluetooth"
     ]
    }
   ],
   "tags": [
    "android-security-16.0.0_r1",
    "android-security-16.0.0_r2"
   ],
   "unannounced": [
    {
     "bug_ids": [
      "418865751"
     ],
     "commits": [
      {
       "project": "platform/art",
       "sha": "f511f3be3d06035b5a2154ad4a56e60756234a5f",
       "subject": "Add notice of requesting source code in art",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/build",
       "sha": "735caf41be17edd4786e7b09b2e6e71bf5c674ea",
       "subject": "Change the logic of checking if open source notice should be displayed",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build",
       "sha": "938d4dfe0a7ab7d25eccd074e123d4f4ea312cb5",
       "subject": "Update html notice to include a notice of requesting source code",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/build/soong",
       "sha": "4e3ec541122121bb403f286287458114ed031112",
       "subject": "Add new notice text for requesting source code",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/external/conscrypt",
       "sha": "bfbf476f81ed7298198af3deea9260cdf7138b83",
       "subject": "Add notice of requesting source code in conscrypt",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/frameworks/av",
       "sha": "d1b598e2702caadfcebbf7210723a588b5c40640",
       "subject": "Add notice of requesting source code in media and media swcodec",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/apps/CellBroadcastReceiver",
       "sha": "9d38400f7fd8dccd37780335f9d396d60b66401c",
       "subject": "Add notice of requesting source code in cellbroadcast",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/apps/DocumentsUI",
       "sha": "1c47fca3355fc5dc3932c8f51e888fa5a94594e1",
       "subject": "Add notice of requesting source code in docsui",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/AdServices",
       "sha": "207f9e95213821cff2b3f7775a430400268a6248",
       "subject": "Add notice of requesting source code in adservices",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/AppSearch",
       "sha": "ad3a3b4e2d4f229a73e3626af6dc500574d9e68c",
       "subject": "Add notice of requesting source code in appsearch",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Bluetooth",
       "sha": "0821ec720a3b7ee658fa06912c766919b8ff5f44",
       "subject": "Add notice of requesting source code in bt",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/CaptivePortalLogin",
       "sha": "5cfb2c8d0b8b6e0559c38eb57ecf707adc8b106a",
       "subject": "Add notice of requesting source code in CaptivePortalLogin",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/ConfigInfrastructure",
       "sha": "61634cb18226446b55d069155a3183ac616adc72",
       "subject": "Add notice of requesting source code in configinfra",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Connectivity",
       "sha": "54ab3969e38f49fc7602678ac2fe4ded1f01cb08",
       "subject": "Add notice of requesting source code in tethering",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/CrashRecovery",
       "sha": "3bd14256f0eb2f0aa42be70cc5684e6cf1da9553",
       "subject": "Add notice of requesting source code in crashrecovery",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/DnsResolver",
       "sha": "9d5f9de849b320b9e50a1b24c1c7685389c6a1c4",
       "subject": "Add notice of requesting source code in resolv",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/ExtServices",
       "sha": "33e7468b60b35fd57e38bb098bffae077fa2862a",
       "subject": "Add notice of requesting source code in ExtService s_minus apk",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/packages/modules/ExtServices",
       "sha": "3844649e11ad971513ac57bc7c5553c1952baca0",
       "subject": "Add notice of requesting source code in ExtService t_plus",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/packages/modules/ExtServices",
       "sha": "37e21e8c7363637f2830ed4586a7253503cf937f",
       "subject": "Add notice of requesting source code in extservices",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/HealthFitness",
       "sha": "313b45e5560f02f07fc1f63140ba932297e7133f",
       "subject": "Add notice of requesting source code in healthfitness",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/IPsec",
       "sha": "2b9813b63372a40c285dc8b6857c0aa3ac7fe45f",
       "subject": "Add notice of requesting source code in ipsec",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/ModuleMetadata",
       "sha": "6beac139eaf92e22031b2b5be172b9954a86da00",
       "subject": "Add notice of requesting source code in modulemetadata",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/NetworkStack",
       "sha": "35dfedb1bf2022a23fc945d0b0c6a86378a97bb0",
       "subject": "Add notice of requesting source code in networkstack",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/NeuralNetworks",
       "sha": "a9fdd34888e9f0a82c4e5f39960e8e63268a0859",
       "subject": "Add notice of requesting source code in neuralnetworks",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Nfc",
       "sha": "f660a3c2bdf346b05733a0ed8bb42f9bbdc03491",
       "subject": "Add notice of requesting source code in nfc",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/OnDevicePersonalization",
       "sha": "5a1eb82c38ac55f66ffbdb926020eb1247e4052e",
       "subject": "Add notice of requesting source code in ondevicepersonalization",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Permission",
       "sha": "754f4454dc5af49d5e4879c156fbc74015547975",
       "subject": "Add notice of requesting source code in the apk-in-apex PermissionController",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Permission",
       "sha": "c42eebda938d419244860bd62c55c1573e1c5a08",
       "subject": "Add notice of requesting source code in permission",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Profiling",
       "sha": "9f633e412aece2c4f64b0cad6697e71508d4a100",
       "subject": "Add notice of requesting source code in profiling",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/RemoteKeyProvisioning",
       "sha": "149562982359d690680089fa688dfa0cd48e108e",
       "subject": "Add notice of requesting source code in rkpd",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Scheduling",
       "sha": "57a13bccaf16bb4479cbb410ba48d7624f527096",
       "subject": "Add notice of requesting source code in scheduling",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/SdkExtensions",
       "sha": "f05b179d3e80228b370350f3b6f59065920e3b08",
       "subject": "Add notice of requesting source code in sdkext",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/StatsD",
       "sha": "8eaf3bfd29b77a1a71c528d65fe7ec6c9eb1c00b",
       "subject": "Add notice of requesting source code in statsd",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/UprobeStats",
       "sha": "006fe24a0773c47efd3728f7edf8bc67b1c26bd3",
       "subject": "Add notice of requesting source code in uprobestats",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Uwb",
       "sha": "52317350756f2d70f3dcd626c24e376beba0d156",
       "subject": "Add notice of requesting source code in uwb",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Wifi",
       "sha": "e0f86c1dd69afec4b90e0d83ddf95233e9d2c22e",
       "subject": "Add notice of requesting source code in wifi",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/modules/adb",
       "sha": "4796395a1d48c3ab9dbd9e3d8f7a9fee5827eaa1",
       "subject": "Add notice of requesting source code in adbd",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/packages/providers/MediaProvider",
       "sha": "393c52e5abeeaebff8cbedfac3f63ad4fe6858fd",
       "subject": "Add notice of requesting source code in mediaprovider",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      },
      {
       "project": "platform/system/timezone",
       "sha": "69b691218d2066ab307d96e957cea8e79c6facbd",
       "subject": "Add notice of requesting source code in tzdata",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "406147398",
      "408478772"
     ],
     "commits": [
      {
       "project": "platform/build",
       "sha": "72615451bab8a026d4f190de82705fd18e5d5982",
       "subject": "Mark \"disable_synthetic_vsync_for_performance\" flag as exported",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "425942317"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "5aaa5eec4fd89194fe6d38d639d185b7833f64cb",
       "subject": "Set BP2A SPL to 2025-08-05",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-20",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "9785521f00a77dcd5f3f552b87d1f9d22240060c",
       "subject": "Set BP2A SPL to 2025-08-05",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-20",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "ca46a8978cd48823c650da46eb2cbbfc16e6db71",
       "subject": "Set BP2A SPL to 2025-08-05",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "415848391"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "9b8e5dd986f09c7a43136540ac5ef2ab4cb8770d",
       "subject": "BP2A: Set SPL to 2025-07-05",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-20",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "80ac296eacba17fc1a71532ce940134e88bc9eab",
       "subject": "Trunk_staging: Set SPL to 2025-07-05",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "5158d6e684ae4d730fa37f94e549834d9b4deb17",
       "subject": "BP2A: Set SPL to 2025-07-05",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "397826126"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "61792fd3a9be4d8750b170b82029a8b7227867d3",
       "subject": "Advance Kernel to Build: 13662627 in 25Q2 shusky",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "03884fd91a3bb0416ec5555b3b4c542363fae1cb",
       "subject": "Advance Kernel to Build: 13662628 in 25Q2 Comet",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "98f30e61cf6ed14f21d263a3936a8d5f416f6e70",
       "subject": "Advance Kernel to Build: 13662626 in 25Q2 Akita",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "54a950f38e1f6c227a6053ed96ff3c1957b7772b",
       "subject": "Advance Kernel to Build: 13662626 in 25Q2 tangorpro",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "b143d0c67494bdd15e3b35894dabfc7a3d533379",
       "subject": "Advance Kernel to Build: 13662626 in 25Q2 felix",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "1cd27fd8d1e4136499d58dc86d474d5366413adf",
       "subject": "Advance Kernel to Build: 13662624 in 25Q2 pantah",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "3b6dce68ab6d846ef073370c7f7dcc4f3829194e",
       "subject": "Advance Kernel to Build: 13662624 in 25Q2 raviole",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "6a4906c4330d6456a71a7dc7a13e3a48eede4154",
       "subject": "Advance Kernel to Build: 13662628 in 25Q2 Caimito",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "b2b4bacb5c0310c7046c61e155fd3d01c5096ee5",
       "subject": "Advance Kernel to Build: 13662626 in 25Q2 lynx",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "8cbc9457bd74bf00655d0944a5c1617136d8b653",
       "subject": "Advance Kernel to Build: 13662625 in 25Q2 bluejay",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "416584782"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "2f8c5a0fe8822b25ddba8a506585e163ad8788d3",
       "subject": "Advance Kernel to Build: 13518276 in 25Q2 bluejay",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-19",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "fd58449a857157e9ad062bcee70b9c10daaae54d",
       "subject": "Advance Kernel to Build: 13499558 in 25Q2 bluejay",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-16",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "e31b466464132dc479f1059ed175c5d76e8a342e",
       "subject": "Advance Kernel to Build: 13492856 in 25Q2 bluejay",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-16",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "413053135"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "0239bfe626e8665fff950d5e18a691c62b33af3e",
       "subject": "Enable Whiskey for BP2A to allow TeamFood.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-16",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "56b57210a0d06b6ccb298b8f1ff722ca38a5bcff",
       "subject": "Advance Kernel to Build: 13426191 in 25Q2 bluejay",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-04-30",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "83079be6b75dd1bd62227d552438608a2d7bddf2",
       "subject": "Enable Whiskey for BP2A to allow TeamFood.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-04-25",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "28bc42391e75146665af0337db887498a550e0b4",
       "subject": "Enable Whiskey for BP2A to allow TeamFood.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-04-23",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "75bca026c92eb847027e9e4bfc5393076dd1335f",
       "subject": "Advance Kernel to Build: 13395649 in 25Q2 bluejay",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-04-23",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "406147398"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "f6a0f88473f4d06c21b76af7c417104ad7d6704b",
       "subject": "Add flag com.android.graphics.surfaceflinger.flags.disable_synthetic_vsync_for_performance to bp2a.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      },
      {
       "project": "platform/frameworks/native",
       "sha": "70a060310fa250740e64831d2a1c9adf8938d88f",
       "subject": "Mark \"disable_synthetic_vsync_for_performance\" flag as exported",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "416369182"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "e7a7a34f421b294258e915a32f27f4cd0e07e92f",
       "subject": "Provide a whiskey kernel respin for .X5 build.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-08",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "414001900"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "0d8aaf0d40fbd6c67685ea39c484f01b7be5765d",
       "subject": "Advance Kernel to Build: 13435191 in 25Q2 raviole",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-01",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "a81c129de692ee3549da00196c4f2c64793a5b92",
       "subject": "Advance Kernel to Build: 13435191 in 25Q2 pantah",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-01",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "406898224"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "2e9f70a5e7d36b22e907f89a1a7bf9ca5b51e140",
       "subject": "Add flag com.android.server.telecom.flags.maybe_default_speaker_after_unhold to bp2a.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-01",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "294133380"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "33299c8afe4372508defb79ec3a6812a09c973fb",
       "subject": "Remove flag com.android.graphics.libgui.flags.buffer_release_channel from bp2a.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-04-30",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "408234063"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "50759c31e3c16ed39b4a60f479be842591c5a330",
       "subject": "BP2A Kernel ReSpin #5",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-04-25",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "413085028",
      "413094446"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "0cad8e1b5983a1640b9da8811355de9fad3a9aad",
       "subject": "Revert the flag for disabling WEP for AAPM",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-04-24",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "410035184"
     ],
     "commits": [
      {
       "project": "platform/build/release",
       "sha": "8cfd7c29e01e6309917b15fa0e3792a6bd8a7d56",
       "subject": "Kernel ReSpin (#3) for 25Q2",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-04-23",
       "markers": []
      },
      {
       "project": "platform/build/release",
       "sha": "3bceb9ecf3dde963203f88209dbb413558aa469c",
       "subject": "Kernel ReSpin (#3) for 25Q2",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-04-23",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "402025928"
     ],
     "commits": [
      {
       "project": "platform/frameworks/base",
       "sha": "0e27558ac3d1454949a6262766dfb4da2c3674aa",
       "subject": "Resolve merge conflict for ag/33497788",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-20",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "409473208"
     ],
     "commits": [
      {
       "project": "platform/frameworks/base",
       "sha": "c1a2f26e2ca5a89f76362db472c781ba1203f222",
       "subject": "Move listener additions within AccessibilityRepository to background",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-20",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "403771473"
     ],
     "commits": [
      {
       "project": "platform/frameworks/base",
       "sha": "15bbf4f74046fd408c70e9bdedb3ee14048243a9",
       "subject": "Change which a11y services we change behavior for",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-20",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "407224281"
     ],
     "commits": [
      {
       "project": "platform/frameworks/base",
       "sha": "252d80a031fe5480268d252a9ede5b8a47953953",
       "subject": "Register IME back callback on new dispatcher",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-19",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "406894719"
     ],
     "commits": [
      {
       "project": "platform/frameworks/base",
       "sha": "457ca54b84bb8f383f114cafe4fcdb773ca8c8e3",
       "subject": "Whiskey icon",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-16",
       "markers": []
      },
      {
       "project": "platform/frameworks/base",
       "sha": "6b642076621d4fa7f8732cb5739803884a6fd7c6",
       "subject": "Change charging string in keyguard",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-16",
       "markers": []
      },
      {
       "project": "platform/packages/apps/Settings",
       "sha": "9fca47cbc1785290b93f1b4176fc16516c981971",
       "subject": "Add battery health tip",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-16",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "411157074"
     ],
     "commits": [
      {
       "project": "platform/frameworks/base",
       "sha": "23ddc74dc0bb589294435253051e614024bb4472",
       "subject": "[SB][Clock] Use tnum spacing if status bar clock has seconds enabled.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      },
      {
       "project": "platform/frameworks/base",
       "sha": "39b099c8a281d2091ec0c0322b5af5da414ec7e4",
       "subject": "[SB] Change status bar clock to normal font instead of tabular font.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "399120953"
     ],
     "commits": [
      {
       "project": "platform/frameworks/native",
       "sha": "f80d65e4abe55c03c67d640f6c6b8eedeb1fbf4a",
       "subject": "Don't blur too many layers",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-08-12",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "342681202",
      "404073995",
      "406147398"
     ],
     "commits": [
      {
       "project": "platform/frameworks/native",
       "sha": "3bfae246fd9db9be5c2002d624b16c970e274590",
       "subject": "Turn off synthetic VSYNC when adjusting thread scheduling for performance",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "404306100"
     ],
     "commits": [
      {
       "project": "platform/packages/apps/Stk",
       "sha": "acdb8666a87d88fc5d6c2c3360ed4e926621793c",
       "subject": "[STK] Fxied edge-to-edge UX support for StkLauncherActivity.",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "315320090",
      "418085016"
     ],
     "commits": [
      {
       "project": "platform/packages/modules/Permission",
       "sha": "f85dfa7980bfc5e29809b3bf065d3682a6db3ff4",
       "subject": "Ensure Gallery always shows as system fixed",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-08-12",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "388234667"
     ],
     "commits": [
      {
       "project": "platform/packages/modules/Permission",
       "sha": "8e95b1f7a24b2b56168634e15e55fecaa680d0f3",
       "subject": "Remove unused variable and rename placeholder ID from ag/33467498",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      },
      {
       "project": "platform/packages/modules/Permission",
       "sha": "01cd09e5fe8d9884903bd1b2dddec42d2c525f8f",
       "subject": "Add title and description for recommended assistants",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-15",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "418343157"
     ],
     "commits": [
      {
       "project": "platform/packages/modules/Scheduling",
       "sha": "e9d961acb47f04583d6af1f5629a6abc405cab7e",
       "subject": "Update com.android.scheduling apex to specify certificate",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-05-29",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    },
    {
     "bug_ids": [
      "425988954"
     ],
     "commits": [
      {
       "project": "platform/packages/services/Telecomm",
       "sha": "20d56535c47417ee07f534585c7fb4d6b215f8b8",
       "subject": "Prevent infinite SPEAKER_OFF looping",
       "tag": "android-security-16.0.0_r1",
       "merged": "2025-06-24",
       "markers": []
      }
     ],
     "tags": [
      "android-security-16.0.0_r1"
     ],
     "tag": "android-security-16.0.0_r1"
    }
   ],
   "coverage": {
    "n_ingested_tags": 9,
    "first_ingested_tag": "android-security-16.0.0_r1",
    "latest_ingested_tag": "android-security-16.0.0_r9",
    "window_base_tag": "android-16.0.0_r2",
    "window_start": "2025-06-10",
    "partial_tags": []
   },
   "platform_update_tags": {},
   "briefs": {
    "CVE-2025-48593": {
     "cve": "CVE-2025-48593",
     "summary": "Removes the btsec_check_valid_discovery_database aconfig flag so that the HF client and SDP checks it gated are always active: cancelling and freeing an existing SDP discovery database before an HF client control block is reinitialised, refusing to start discovery when a database already exists, and checking for a missing database in SDP search-attribute response processing.",
     "component": "platform/packages/modules/Bluetooth, system/bta/hf_client (Hands-Free client BTA) and system/stack/sdp (SDP discovery)",
     "weakness": "Use-after-free risk on an SDP discovery database (tSDP_DISCOVERY_DB) across HF client control block reinitialisation and discovery setup (per the in-code comment); missing NULL check on p_ccb->p_db in SDP response processing",
     "root_cause": "In the Android 16 tree three guards existed but were only active when the aconfig flag btsec_check_valid_discovery_database was enabled. With the flag off: (1) system/bta/hf_client/bta_hf_client_main.cc bta_hf_client_cb_init() zeroed the control block with `*client_cb = {}` without cancelling an outstanding SDP service search or freeing client_cb->p_disc_db; (2) system/bta/hf_client/bta_hf_client_sdp.cc bta_hf_client_do_disc() allocated a fresh p_disc_db even when one was already set, which the in-code comment says can cause a race condition leading to UAF once the connection is closed; (3) system/stack/sdp/sdp_discovery.cc process_service_search_attr_rsp() did not check p_ccb->p_db for NULL.",
     "fix_analysis": [
      "flags/security.aconfig: deletes the flag definition btsec_check_valid_discovery_database (bug 356201480). The three call sites below drop their flag condition, so the guards become unconditional.",
      "system/bta/hf_client/bta_hf_client_main.cc:bta_hf_client_cb_init: the condition becomes `if (client_cb->p_disc_db)`. When a database is set, SDP_CancelServiceSearch() is called via get_legacy_stack_sdp_api()->service (with a warn log on failure), and the database is released with osi_free_and_reset((void**)&client_cb->p_disc_db) before the block is zeroed.",
      "system/bta/hf_client/bta_hf_client_sdp.cc:bta_hf_client_do_disc: the condition becomes `if (client_cb->p_disc_db != NULL)`. A pre-existing database now always causes an error log, p_disc_db set to NULL, client_cb->state reset to 0 (BTA_HF_CLIENT_INIT_ST) and an early return, instead of allocating a second database and starting a new SDP_ServiceSearchAttributeRequest2.",
      "system/stack/sdp/sdp_discovery.cc:process_service_search_attr_rsp: the condition becomes `if (p_ccb->p_db == NULL)`. A continuation or first-time request on a connection without a discovery database now always takes the warn-log branch. The rest of that branch is not shown in the diff."
     ],
     "completeness": [
      "Covers the three gated sites: HF client control block reinit, HF client discovery start, and SDP search-attribute response processing.",
      "In bta_hf_client_cb_init the database is freed even if SDP_CancelServiceSearch() returns false (only a warning is logged). The code shown does not indicate what the SDP layer does with its database pointer in that case.",
      "In bta_hf_client_do_disc the pre-existing p_disc_db is set to NULL rather than freed. Who owns or frees that buffer is not shown in the material.",
      "The Android 14 and 15 fix commits shown add only the bta_hf_client_cb_init guard. The material does not show whether the bta_hf_client_do_disc and process_service_search_attr_rsp guards exist on those branches.",
      "Other code touching client_cb->p_disc_db (for example the SDP callback and free paths in bta_hf_client_sdp.cc) is not shown and is not changed by this commit."
     ],
     "behavior_changes": [
      "The checks no longer depend on the runtime aconfig flag. Behaviour is unchanged on devices that already had the flag enabled.",
      "Reinitialising an HF client control block that still owns a discovery database now cancels the outstanding SDP search and frees the database (possible warn log 'Unable to cancel SDP service discovery peer').",
      "Calling bta_hf_client_do_disc with an existing database now logs 'Tried to set up a HF client with a preexisting discovery database.', resets the client state to INIT and does not start discovery.",
      "An SDP service-search-attribute request or response on a connection without a database now logs 'Attempted continuation or first time request with invalid discovery database'. The handling after the log is not shown."
     ],
     "preconditions": [
      "A Bluetooth stack using the Hands-Free client (HF unit) role. Per index search, bta_hf_client_start_open (outgoing, BTA_HF_CLIENT_INT) in system/bta/hf_client/bta_hf_client_act.cc calls bta_hf_client_do_disc. The index also lists bta_hf_client_rfc_acp_open (incoming RFCOMM, BTA_HF_CLIENT_ACP) as a caller, but its snippet is cut off before any call.",
      "An HF client control block must be reinitialised, or discovery restarted, while an SDP discovery database is still attached. The in-code comment says this 'should only happen with malicious modifications to a client'.",
      "For the sdp_discovery.cc guard: SDP service search attribute processing on a connection whose p_db is NULL.",
      "On Android 16 before this commit, the guards were inactive only if the btsec_check_valid_discovery_database flag was disabled."
     ],
     "per_major": {
      "14": "Adapted fix: commit 75ecc79c24e0 (android-security-14.0.0_r23) adds the bta_hf_client_cb_init guard without a flag, using direct SDP_CancelServiceSearch() and APPL_TRACE_WARNING. It also adds stubs in system/bta/test/bta_dip_test.cc (sdpu_find_ccb_by_db, sdp_disconnect) and bta_hf_client_add_record_test.cc (SDP_CancelServiceSearch). 8/8 lines of the patched region are present at android-security-14.0.0_r29. The do_disc and sdp_discovery.cc guards are not in the shown commit.",
      "15": "Adapted fix: commit c69c78d7c4f6 (android-security-15.0.0_r11) adds the bta_hf_client_cb_init guard without a flag, via get_legacy_stack_sdp_api()->service.SDP_CancelServiceSearch and log::warn. 5/5 lines are present at android-security-15.0.0_r17. The do_disc and sdp_discovery.cc guards are not in the shown commit.",
      "16": "Flag removal: commit 5ed63461b441 (android-security-16.0.0_r2) deletes btsec_check_valid_discovery_database and makes the three existing guards unconditional. At android-security-16.0.0_r8 the bta_hf_client_main.cc and bta_hf_client_sdp.cc guards are present without the flag (5/8 lines of the patched region matched). The sdp_discovery.cc region is not shown in the provided context.",
      "17": "Not affected: the bulletin does not list Android 17. 3/8 lines of the patched region are present at android-security-17.0.0_r1; the material does not show the Android 17 code."
     },
     "backport_notes": [
      "On branches that contain the flagged checks, apply this commit as-is. On branches without them, port the guards directly without a flag, as was done on 14 and 15, and consider also adding the bta_hf_client_do_disc and process_service_search_attr_rsp guards, which the 14/15 commits shown do not include.",
      "Android 14 uses the direct SDP_CancelServiceSearch()/APPL_TRACE_WARNING API rather than get_legacy_stack_sdp_api()/log::warn. Its fix commit also adds test stubs in bta_dip_test.cc and bta_hf_client_add_record_test.cc."
     ],
     "confidence": "medium",
     "unknowns": [
      "The original flagged commit that introduced the three guards on Android 16 is not in the material; only the flag removal is shown.",
      "The rest of the `p_ccb->p_db == NULL` branch in process_service_search_attr_rsp (what happens after the warn log) is cut off in the diff.",
      "Whether the bta_hf_client_do_disc and process_service_search_attr_rsp guards were backported to Android 14/15 by other commits.",
      "How the SDP layer handles tCONN_CB::p_db after a failed SDP_CancelServiceSearch, or after do_disc sets p_disc_db to NULL without freeing it.",
      "The exact remote trigger path. The bulletin rates this Critical RCE, but the material does not show the triggering sequence.",
      "Whether bta_hf_client_rfc_acp_open actually calls bta_hf_client_do_disc; the index snippet is cut off."
     ],
     "meta": {
      "generated": "2026-10-02",
      "author_model": "claude-fable-5-1",
      "review_model": "claude-opus-5-5",
      "review_corrections": 6,
      "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material."
     }
    }
   }
  },
  "17": {
   "counts": {
    "announced": 0,
    "certain": 0,
    "probable": 0,
    "not_published": 0,
    "not_covered": 0,
    "awaiting": 0
   },
   "advisories": [],
   "tags": [],
   "unannounced": [],
   "coverage": {
    "n_ingested_tags": 2,
    "first_ingested_tag": "android-security-17.0.0_r1",
    "latest_ingested_tag": "android-security-17.0.0_r2",
    "window_base_tag": "android-17.0.0_r1",
    "window_start": "2026-06-16",
    "partial_tags": []
   },
   "platform_update_tags": {},
   "briefs": {}
  }
 },
 "bulletin": {
  "url": "https://source.android.com/docs/security/bulletin/2025-11-01",
  "latest_version": "1.2",
  "latest_revision": {
   "version": "1.2",
   "date": "April 17, 2026",
   "notes": "Updated Issue List"
  },
  "revisions": [
   {
    "version": "1.0",
    "date": "November 3, 2025",
    "notes": "Bulletin Published"
   },
   {
    "version": "1.1",
    "date": "November 14, 2025",
    "notes": "Bulletin updated"
   },
   {
    "version": "1.2",
    "date": "April 17, 2026",
    "notes": "Updated Issue List"
   }
  ],
  "tracked_since": "2026-09-30",
  "changes_since_tracking": [],
  "out_of_scope_rows": {},
  "note": "changes are only visible from `tracked_since`; earlier revisions of the bulletin cannot be reconstructed. Out-of-scope rows (vendor closed-source, kernel) have no public AOSP code to resolve."
 }
}