[Lock Screen Bypass / Hidden Contents Shown on Lock Screen / Add new users to Pixel device from Lock Screen Transition ]

In several functions of KeyguardServiceWrapper.java and related files, there is a possible way to briefly view what’s under the lockscreen due to a race condition. This could lead to local escalation of privilege if a Guest user is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation.