CVE-2026-0046 AI-generated analysis

platform/frameworks/base, WindowManager (services/core/java/com/android/server/wm/Letterbox.java)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

The fix makes the Letterbox input window (InputInterceptor in Letterbox.java) report the surrounded app's pid/uid as its owner instead of system_server's, so the input layer's obscured-touch (tapjacking) checks no longer treat the letterbox as a trusted system window.

Root cause

In the Letterbox.InputInterceptor constructor, the InputWindowHandle created for the letterbox black bars was given ownerPid = WindowManagerService.MY_PID and ownerUid = WindowManagerService.MY_UID, with inputConfig NOT_FOCUSABLE | SLIPPERY and layoutParamsType TYPE_INPUT_CONSUMER. Per the commit message, the letterbox window was therefore considered a trusted system window. A touch could slip out of the letterbox bar and reach activities underneath that the user could not see because the letterbox covered them, and the existing tapjacking prevention did not work correctly for those touches.

How the fix works

• services/core/java/com/android/server/wm/Letterbox.java : InputInterceptor(String namePrefix, WindowState win): replaces mWindowHandle.ownerPid = WindowManagerService.MY_PID / ownerUid = WindowManagerService.MY_UID with mWindowHandle.ownerPid = win.mSession.mPid / ownerUid = win.mSession.mUid. The letterbox input window now takes on the identity of the app window it surrounds.
• With the app's uid as owner, the letterbox is no longer treated as a trusted system window for input security checks, so the obscured-touch logic applies (per the commit message and code comment).
• No other fields change: token, layoutParamsType, dispatchingTimeoutMillis, scaleFactor and inputConfig (NOT_FOCUSABLE | SLIPPERY) are untouched. The TapEventReceiver is still created with the WindowManagerService context.

Completeness

• Covers the single place where the letterbox InputWindowHandle is constructed (the Letterbox.InputInterceptor constructor). All letterbox surfaces created through this interceptor get the change.
• The fix changes only ownership attribution. It does not change the SLIPPERY input config, so touches can still slip out of the letterbox. The mitigation relies on the downstream obscured-touch logic now treating the letterbox as an app window.
• Relies on win.mSession being non-null for the WindowState passed to InputInterceptor. No null handling was added.

Behavior changes

• The letterbox input window is now reported to the input system with the surrounded app's pid/uid rather than system_server's, so trust-based input decisions (obscured/untrusted-touch handling) treat it as belonging to that app.
• The material does not show which other consumers of ownerPid/ownerUid for this handle are affected.

Per major

• Android 14: same fix: 8284ae9c703a in android-security-14.0.0_r28, a single-file change in Letterbox.java; 7/7 lines present at android-security-14.0.0_r29.
• Android 15: same fix: 8eb831ece18d in android-security-15.0.0_r16, identical hunk at a different line offset; 7/7 lines present at android-security-15.0.0_r17.
• Android 16: same fix in different context: 678475b0c23c in android-security-16.0.0_r7. Same ownerPid/ownerUid replacement, but the surrounding lines differ (layoutParamsType is a conditional TYPE_APPLICATION_OVERLAY/TYPE_INPUT_CONSUMER, and inputConfig uses Flags.scrollingFromLetterbox() ? SPY : SLIPPERY); 8/8 lines present at android-security-16.0.0_r8.
• Android 17: not affected: the bulletin does not list Android 17. At android-security-17.0.0_r1, 5/7 lines of the patched region are present.

Unknowns

• The exact downstream input check (in InputDispatcher or WindowManager) that uses ownerUid to decide trusted vs obscured is not shown in the material.
• Whether the three internal Cherrypick-From changes included anything beyond the Letterbox.java hunk.
• State of the ownerPid/ownerUid assignment in Android 17 (only 5/7 lines of the region present at android-security-17.0.0_r1).
• Whether other system-created input-consumer handles also use WindowManagerService.MY_PID/MY_UID with comparable exposure (the index search failed).
• Whether the change affects ANR/dispatch-timeout attribution for the letterbox channel.

Back to June 2026 · Findings