CVE-2025-48621 AI-generated analysis

platform/frameworks/native (inputflinger InputDispatcher) and platform/frameworks/base (libs/WindowManager/Shell transition, DefaultTransitionHandler)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Two linked changes under bug 266433089: InputDispatcher stops delivering motion events to windows that use TouchOcclusionMode::USE_OPACITY while their alpha is below 0.5, and the WM Shell DefaultTransitionHandler lowers MAX_ANIMATION_DURATION from 3000 to 1500. The commit message frames this as reducing tapjacking risk during animations.

Root cause

InputDispatcher::canWindowReceiveMotionLocked checked targeted injection validity, PAUSE_DISPATCHING, NO_INPUT_CHANNEL, connection presence and responsiveness, but it never considered the window's alpha. A window declared opaque (touchOcclusionMode USE_OPACITY) therefore kept receiving touches even when its alpha was low, for example during a fade-out animation. Separately, DefaultTransitionHandler defined MAX_ANIMATION_DURATION as 3000. The commit message calls this "way too long, especially for tap jacking exploitation during animation".

How the fix works

• services/inputflinger/dispatcher/InputDispatcher.cpp:InputDispatcher::canWindowReceiveMotionLocked (frameworks/native 0433b19e7d1c): adds `if (info.touchOcclusionMode == TouchOcclusionMode::USE_OPACITY && info.alpha < 0.5f)` as the first check. When it matches, the function logs at INFO and returns false, so the window cannot receive the motion event.
• libs/WindowManager/Shell/src/com/android/wm/shell/transition/DefaultTransitionHandler.java (frameworks/base 848e575f07ff): changes the constant MAX_ANIMATION_DURATION from 3000 to 1500. Per the commit message, this cuts the maximum duration of the default transition.
• Both commits are RESTRICT AUTOMERGE cherry-picks (Merged-In I4134b2512cf1d0c7bff595db1e011a3357ff130a and I5afd5c942b8f96347398a9b0aaafda28dc83d789) in separate projects. The material does not state a required order between them.

Completeness

• The alpha check applies only to windows whose touchOcclusionMode is USE_OPACITY. canWindowReceiveMotionLocked does not filter windows in other occlusion modes by alpha.
• The 0.5f threshold is hardcoded. A window with alpha at or above 0.5 is not blocked by this check.
• The duration cap is changed only in DefaultTransitionHandler. The material does not show how MAX_ANIMATION_DURATION is applied, or whether other transition handlers have their own duration limits. On Android 16, the separate SIZE_CHANGE_ANIMATION_DURATION (400) constant is unchanged.
• The code context at android-security-14.0.0_r29 shows both changes: the alpha check at InputDispatcher.cpp line 4921 and MAX_ANIMATION_DURATION = 1500 at DefaultTransitionHandler.java line 121.

Behavior changes

• Motion events are no longer dispatched to a USE_OPACITY window whose alpha is below 0.5. In that case an INFO log line 'Not sending motion to <window>, window opacity=<alpha> is below the threshold' is emitted.
• The DefaultTransitionHandler maximum animation duration constant is now 1500 instead of 3000. The material does not show exactly how the limit is enforced.

Per major

• Android 14: Same fix: frameworks/base 848e575f07ff and frameworks/native 0433b19e7d1c in android-security-14.0.0_r24. Both changes are visible in the android-security-14.0.0_r29 context (resolver: 4/5 lines of the patched region present).
• Android 15: Same fix for frameworks/base: 06e697583c87 in android-security-15.0.0_r12, the identical one-line constant change (3000 -> 1500). The matching frameworks/native commit for 15 is not shown in the material (resolver: resolved, 4/5 lines present at 15.0.0_r17).
• Android 16: Same fix for frameworks/base: 6d1697c96c5c in android-security-16.0.0_r3, the identical constant change next to an unchanged SIZE_CHANGE_ANIMATION_DURATION = 400 line. The frameworks/native commit for 16 is not shown (resolver: resolved, 4/5 lines present at 16.0.0_r8).
• Android 17: Not affected: the bulletin does not list Android 17. The resolver reports 4/5 lines of the patched region present at android-security-17.0.0_r1.

Unknowns

• How MAX_ANIMATION_DURATION is used inside DefaultTransitionHandler (the clamping site is not in the material).
• The frameworks/native commits for Android 15 and 16, and whether their diffs match the Android 14 one.
• Whether the two commits depend on each other.
• Which specific windows or animations were involved in the reported issue. The material only gives the tapjacking rationale from the commit messages.
• The test changes referenced by 'Test: inputflinger_tests', which are not included.

Back to December 2025 · Findings