CVE-2025-48639 AI-generated analysis

platform/frameworks/base, libs/WindowManager/Shell (WM Shell transitions, DefaultTransitionHandler)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

Halves the maximum animation duration enforced by WM Shell's DefaultTransitionHandler (MAX_ANIMATION_DURATION 3000 -> 1500 ms) to shrink the window in which a running transition animation can be used for tap-jacking.

Root cause

DefaultTransitionHandler, the fallback handler for window transitions in WM Shell, defines the constant MAX_ANIMATION_DURATION, which was set to 3000 ms. Per the commit message, 3 seconds is too long, especially because it allows tap-jacking while the animation is running. The material shows only the constant's definition, not where it is applied.

How the fix works

• libs/WindowManager/Shell/src/com/android/wm/shell/transition/DefaultTransitionHandler.java: the class constant MAX_ANIMATION_DURATION is changed from 3000 to 1500. Any duration this handler clamps against the constant is now limited to 1.5 s instead of 3 s. The fix is a single-line change in one file, with no change to logic or API. It is a RESTRICT AUTOMERGE backport (Change-Id I5afd5c942b8f96347398a9b0aaafda28dc83d789, bug 266433089).

Completeness

• The fix only lowers the clamp value. Animations during a transition still run, so a window of up to 1500 ms remains by design.
• Only DefaultTransitionHandler is touched. The commit does not change animation paths that are not clamped by MAX_ANIMATION_DURATION, or that are handled by another Transitions.TransitionHandler. The material does not show these paths.
• The code context does not show where MAX_ANIMATION_DURATION is used, so the material cannot confirm which animations are subject to the new cap.

Behavior changes

• Transition animations clamped by DefaultTransitionHandler are limited to 1500 ms instead of 3000 ms.
• No new error paths, permissions or API changes.

Per major

• Android 14: same fix: platform/frameworks/base 848e575f07ff in android-security-14.0.0_r24 (RESTRICT AUTOMERGE backport); the constant is 1500 at android-security-14.0.0_r29.
• Android 15: same fix: platform/frameworks/base 06e697583c87 in android-security-15.0.0_r12, identical one-line change; 4/5 lines of the patched region present at android-security-15.0.0_r17.
• Android 16: same fix: platform/frameworks/base 6d1697c96c5c in android-security-16.0.0_r3, identical one-line change (the hunk context also includes the adjacent SIZE_CHANGE_ANIMATION_DURATION line); 4/5 lines of the patched region present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); 4/5 lines of the patched region present at android-security-17.0.0_r1.

Unknowns

• Where and how MAX_ANIMATION_DURATION is applied (which animation durations are clamped) is not shown in the code context.
• The bulletin lists Android 13 as affected, but no Android 13 fix commit is included in the material.
• How an app can extend a transition animation up to the cap is not shown.
• The value of MAX_ANIMATION_DURATION at android-security-17.0.0_r1 is not shown.

Back to December 2025 · Findings