diff --git a/tests/PhotoPicker/src/android/photopicker/cts/PhotoPickerSettingsTest.java b/tests/PhotoPicker/src/android/photopicker/cts/PhotoPickerSettingsTest.java
index bfa0462..83fefd4 100644
--- a/tests/PhotoPicker/src/android/photopicker/cts/PhotoPickerSettingsTest.java
+++ b/tests/PhotoPicker/src/android/photopicker/cts/PhotoPickerSettingsTest.java
@@ -29,6 +29,7 @@
 import org.junit.AfterClass;
 import org.junit.Assume;
 import org.junit.BeforeClass;
+import org.junit.Ignore;
 import org.junit.Test;
 
 /**
@@ -80,6 +81,7 @@
     }
 
     @Test
+    @Ignore("TODO(b/195009187): Enable this test once fixed and settings activity is enabled.")
     public void testSettingsLaunchFromOverflowMenu() throws Exception {
         // Launch PhotoPickerActivity.
         final Intent intent = new Intent(MediaStore.ACTION_PICK_IMAGES);
diff --git a/tests/tests/permission/Android.bp b/tests/tests/permission/Android.bp
index 91a9dfc..27ccdc3 100644
--- a/tests/tests/permission/Android.bp
+++ b/tests/tests/permission/Android.bp
@@ -115,6 +115,7 @@
         ":CtsVictimPermissionDefinerApp",
         ":CtsAppThatRequestsSystemAlertWindow22",
         ":CtsAppThatRequestsSystemAlertWindow23",
+        ":CtsAppThatRequestCustomCameraPermission",
     ],
     per_testcase_directory: true,
 }
diff --git a/tests/tests/permission/AndroidTest.xml b/tests/tests/permission/AndroidTest.xml
index eafc6a6..368f94e 100644
--- a/tests/tests/permission/AndroidTest.xml
+++ b/tests/tests/permission/AndroidTest.xml
@@ -94,6 +94,7 @@
         <option name="push" value="CtsAppThatHasNotificationListener.apk->/data/local/tmp/cts/permissions/CtsAppThatHasNotificationListener.apk" />
         <option name="push" value="CtsAppThatRequestsSystemAlertWindow22.apk->/data/local/tmp/cts/permissions/CtsAppThatRequestsSystemAlertWindow22.apk" />
         <option name="push" value="CtsAppThatRequestsSystemAlertWindow23.apk->/data/local/tmp/cts/permissions/CtsAppThatRequestsSystemAlertWindow23.apk" />
+        <option name="push" value="CtsAppThatRequestCustomCameraPermission.apk->/data/local/tmp/cts/permissions/CtsAppThatRequestCustomCameraPermission.apk" />
     </target_preparer>
 
     <!-- Remove additional apps if installed -->
diff --git a/tests/tests/permission/AppThatRequestCustomCameraPermission/Android.bp b/tests/tests/permission/AppThatRequestCustomCameraPermission/Android.bp
new file mode 100644
index 0000000..873733d
--- /dev/null
+++ b/tests/tests/permission/AppThatRequestCustomCameraPermission/Android.bp
@@ -0,0 +1,37 @@
+//
+// Copyright (C) 2022 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test_helper_app {
+    name: "CtsAppThatRequestCustomCameraPermission",
+    defaults: [
+        "cts_defaults",
+        "mts-target-sdk-version-current",
+    ],
+    min_sdk_version: "30",
+    // Tag this module as a cts test artifact
+    test_suites: [
+        "cts",
+        "mts",
+        "sts",
+        "general-tests",
+    ],
+    srcs: ["src/**/*.java"],
+    resource_dirs: ["res"],
+}
diff --git a/tests/tests/permission/AppThatRequestCustomCameraPermission/AndroidManifest.xml b/tests/tests/permission/AppThatRequestCustomCameraPermission/AndroidManifest.xml
new file mode 100644
index 0000000..a8143a7
--- /dev/null
+++ b/tests/tests/permission/AppThatRequestCustomCameraPermission/AndroidManifest.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.permission.cts.appthatrequestcustomcamerapermission">
+
+    <permission android:name="appthatrequestcustomcamerapermission.CUSTOM"
+                android:permissionGroup="android.permission-group.CAMERA"
+                android:label="@string/permlab_custom"
+                android:description="@string/permdesc_custom"
+                android:protectionLevel="dangerous" />
+
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-permission android:name="appthatrequestcustomcamerapermission.CUSTOM" />
+
+    <application>
+        <activity android:name=".RequestCameraPermission" android:exported="true"
+                  android:visibleToInstantApps="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>
diff --git a/tests/tests/permission/AppThatRequestCustomCameraPermission/res/values/strings.xml b/tests/tests/permission/AppThatRequestCustomCameraPermission/res/values/strings.xml
new file mode 100644
index 0000000..8de4638
--- /dev/null
+++ b/tests/tests/permission/AppThatRequestCustomCameraPermission/res/values/strings.xml
@@ -0,0 +1,20 @@
+<!--
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+
+<resources>
+    <string name="permlab_custom">Custom</string>
+    <string name="permdesc_custom">allows bypassing one-time permissions</string>
+</resources>
\ No newline at end of file
diff --git a/tests/tests/permission/AppThatRequestCustomCameraPermission/src/android/permission/cts/appthatrequestcustomcamerapermission/RequestCameraPermission.java b/tests/tests/permission/AppThatRequestCustomCameraPermission/src/android/permission/cts/appthatrequestcustomcamerapermission/RequestCameraPermission.java
new file mode 100644
index 0000000..4bbeb53
--- /dev/null
+++ b/tests/tests/permission/AppThatRequestCustomCameraPermission/src/android/permission/cts/appthatrequestcustomcamerapermission/RequestCameraPermission.java
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.permission.cts.appthatrequestcustomcamerapermission;
+
+import static android.Manifest.permission.CAMERA;
+import static android.content.pm.PackageManager.PERMISSION_GRANTED;
+
+import android.app.Activity;
+import android.os.Bundle;
+import android.os.Handler;
+import android.util.Log;
+
+public class RequestCameraPermission extends Activity {
+
+    private static final String LOG_TAG = RequestCameraPermission.class.getSimpleName();
+
+    public static final String CUSTOM_PERMISSION = "appthatrequestcustomcamerapermission.CUSTOM";
+    private Handler mHandler;
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+
+        boolean cameraGranted =
+                checkSelfPermission(CAMERA) == PERMISSION_GRANTED;
+        boolean customGranted =
+                checkSelfPermission(CUSTOM_PERMISSION) == PERMISSION_GRANTED;
+
+        mHandler = new Handler(getMainLooper());
+
+        if (!cameraGranted && !customGranted) {
+            requestPermissions(new String[] {CAMERA}, 0);
+        } else {
+            Log.e(LOG_TAG, "Test app was opened with cameraGranted=" + cameraGranted
+                    + " and customGranted=" + customGranted);
+        }
+    }
+
+    @Override
+    public void onRequestPermissionsResult(int requestCode, String[] permissions,
+            int[] grantResults) {
+        super.onRequestPermissionsResult(requestCode, permissions, grantResults);
+
+        if (requestCode == 0) {
+            if (grantResults[0] != PERMISSION_GRANTED) {
+                Log.e(LOG_TAG, "permission wasn't granted, this test should fail,"
+                        + " leaving test app open.");
+            } else {
+                // Delayed request because the immediate request might show the dialog again
+                mHandler.postDelayed(() ->
+                        requestPermissions(new String[] {CUSTOM_PERMISSION}, 1), 500);
+            }
+        } else if (requestCode == 1) {
+            if (grantResults[0] != PERMISSION_GRANTED) {
+                Log.e(LOG_TAG, "permission wasn't granted, this test should fail,"
+                        + " leaving test app open.");
+            } else {
+                // Here camera was granted and custom was autogranted, exit process and let test
+                // verify both are revoked.
+
+                // Delayed exit because b/254675301
+                mHandler.postDelayed(() -> System.exit(0), 1000);
+            }
+        }
+
+    }
+}
diff --git a/tests/tests/permission/src/android/permission/cts/OneTimePermissionTest.java b/tests/tests/permission/src/android/permission/cts/OneTimePermissionTest.java
index c24d244..05bc542 100644
--- a/tests/tests/permission/src/android/permission/cts/OneTimePermissionTest.java
+++ b/tests/tests/permission/src/android/permission/cts/OneTimePermissionTest.java
@@ -17,6 +17,7 @@
 package android.permission.cts;
 
 import static android.Manifest.permission.ACCESS_FINE_LOCATION;
+import static android.Manifest.permission.CAMERA;
 import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_CACHED;
 import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND;
 import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND_SERVICE;
@@ -31,6 +32,7 @@
 import android.content.Context;
 import android.content.Intent;
 import android.content.pm.PackageManager;
+import android.platform.test.annotations.AsbSecurityTest;
 import android.provider.DeviceConfig;
 import android.support.test.uiautomator.By;
 import android.support.test.uiautomator.UiDevice;
@@ -53,13 +55,19 @@
 
 public class OneTimePermissionTest {
     private static final String APP_PKG_NAME = "android.permission.cts.appthatrequestpermission";
+    private static final String CUSTOM_CAMERA_PERM_APP_PKG_NAME =
+            "android.permission.cts.appthatrequestcustomcamerapermission";
     private static final String APK =
             "/data/local/tmp/cts/permissions/CtsAppThatRequestsOneTimePermission.apk";
+    private static final String CUSTOM_CAMERA_PERM_APK =
+            "/data/local/tmp/cts/permissions/CtsAppThatRequestCustomCameraPermission.apk";
     private static final String EXTRA_FOREGROUND_SERVICE_LIFESPAN =
             "android.permission.cts.OneTimePermissionTest.EXTRA_FOREGROUND_SERVICE_LIFESPAN";
     private static final String EXTRA_FOREGROUND_SERVICE_STICKY =
             "android.permission.cts.OneTimePermissionTest.EXTRA_FOREGROUND_SERVICE_STICKY";
 
+    public static final String CUSTOM_PERMISSION = "appthatrequestcustomcamerapermission.CUSTOM";
+
     private static final long ONE_TIME_TIMEOUT_MILLIS = 5000;
     private static final long ONE_TIME_KILLED_DELAY_MILLIS = 5000;
     private static final long ONE_TIME_TIMER_LOWER_GRACE_PERIOD = 1000;
@@ -67,6 +75,7 @@
 
     private final Context mContext =
             InstrumentationRegistry.getInstrumentation().getTargetContext();
+    private final PackageManager mPackageManager = mContext.getPackageManager();
     private final UiDevice mUiDevice =
             UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
     private final ActivityManager mActivityManager =
@@ -89,6 +98,7 @@
     @Before
     public void installApp() {
         runShellCommand("pm install -r " + APK);
+        runShellCommand("pm install -r " + CUSTOM_CAMERA_PERM_APK);
     }
 
     @Before
@@ -109,6 +119,7 @@
     @After
     public void uninstallApp() {
         runShellCommand("pm uninstall " + APP_PKG_NAME);
+        runShellCommand("pm uninstall " + CUSTOM_CAMERA_PERM_APP_PKG_NAME);
     }
 
     @After
@@ -215,9 +226,36 @@
         }));
     }
 
+    @Test
+    @AsbSecurityTest(cveBugId = 237405974L)
+    public void testCustomPermissionIsGrantedOneTime() throws Throwable {
+        Intent startApp = new Intent()
+                .setComponent(new ComponentName(CUSTOM_CAMERA_PERM_APP_PKG_NAME,
+                        CUSTOM_CAMERA_PERM_APP_PKG_NAME + ".RequestCameraPermission"))
+                .addFlags(FLAG_ACTIVITY_NEW_TASK);
+
+        mContext.startActivity(startApp);
+
+        // We're only manually granting CAMERA, but the app will later request CUSTOM and get it
+        // granted silently. This is intentional since it's in the same group but both should
+        // eventually be revoked
+        clickOneTimeButton();
+
+        // Just waiting for the revocation
+        eventually(() -> Assert.assertEquals(PackageManager.PERMISSION_DENIED,
+                mContext.getPackageManager()
+                        .checkPermission(CAMERA, CUSTOM_CAMERA_PERM_APP_PKG_NAME)));
+
+        // This checks the vulnerability
+        eventually(() -> Assert.assertEquals(PackageManager.PERMISSION_DENIED,
+                mContext.getPackageManager()
+                        .checkPermission(CUSTOM_PERMISSION, CUSTOM_CAMERA_PERM_APP_PKG_NAME)));
+
+    }
+
     private void assertGrantedState(String s, int permissionGranted, long timeoutMillis) {
         eventually(() -> Assert.assertEquals(s,
-                permissionGranted, mContext.getPackageManager()
+                permissionGranted, mPackageManager
                         .checkPermission(ACCESS_FINE_LOCATION, APP_PKG_NAME)), timeoutMillis);
     }
 
diff --git a/tests/tests/sdksandbox/webkit/Android.bp b/tests/tests/sdksandbox/webkit/Android.bp
new file mode 100644
index 0000000..5eb4236
--- /dev/null
+++ b/tests/tests/sdksandbox/webkit/Android.bp
@@ -0,0 +1,44 @@
+// Copyright (C) 2022 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test {
+    name: "CtsSdkSandboxWebkitTestCases",
+    defaults: ["cts_defaults"],
+    libs: [
+        "android.test.runner",
+        "android.test.base",
+    ],
+    static_libs: [
+        "compatibility-device-util-axt",
+        "ctstestrunner-axt",
+        "CtsSdkSandboxTestScenario",
+    ],
+    data: [
+        ":EmptySdkProviderApp",
+        ":WebViewSandboxTestSdk",
+    ],
+    srcs: [
+        "src/**/*.java",
+        "src/**/*.aidl",
+    ],
+    test_suites: [
+        "cts",
+        "general-tests",
+    ],
+    sdk_version: "current",
+}
diff --git a/tests/tests/sdksandbox/webkit/AndroidManifest.xml b/tests/tests/sdksandbox/webkit/AndroidManifest.xml
new file mode 100644
index 0000000..f0fb9cb
--- /dev/null
+++ b/tests/tests/sdksandbox/webkit/AndroidManifest.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          package="android.sdksandbox.webkit.cts">
+
+    <uses-permission android:name="android.permission.DISABLE_KEYGUARD"/>
+    <uses-permission android:name="android.permission.INTERNET"/>
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
+
+    <application android:maxRecents="1">
+        <uses-library android:name="android.test.runner"/>
+        <uses-sdk-library android:name="com.android.emptysdkprovider"
+                          android:versionMajor="1"
+                          android:certDigest="0B:44:2D:88:FA:A7:B3:AD:23:8D:DE:29:8A:A1:9B:D5:62:03:92:0B:BF:D8:D3:EB:C8:99:33:2C:8E:E1:15:99"/>
+        <uses-sdk-library android:name="com.android.cts.sdksidetests.webviewsandboxtest"
+                          android:versionMajor="1"
+                          android:certDigest="0B:44:2D:88:FA:A7:B3:AD:23:8D:DE:29:8A:A1:9B:D5:62:03:92:0B:BF:D8:D3:EB:C8:99:33:2C:8E:E1:15:99"/>
+    </application>
+
+    <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
+                     android:targetPackage="android.sdksandbox.webkit.cts"
+                     android:label="CTS tests of android.sdksandbox.webkit">
+        <meta-data android:name="listener"
+                   android:value="com.android.cts.runner.CtsTestRunListener"/>
+    </instrumentation>
+
+</manifest>
diff --git a/tests/tests/sdksandbox/webkit/AndroidTest.xml b/tests/tests/sdksandbox/webkit/AndroidTest.xml
new file mode 100644
index 0000000..7d0ee23
--- /dev/null
+++ b/tests/tests/sdksandbox/webkit/AndroidTest.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for CTS SdkSandbox Webkit test cases">
+    <option name="test-suite-tag" value="cts"/>
+    <option name="config-descriptor:metadata" key="component" value="webview"/>
+    <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
+    <option name="config-descriptor:metadata" key="parameter" value="not_multi_abi" />
+    <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
+    <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
+        <option name="cleanup-apks" value="true"/>
+        <option name="test-file-name" value="WebViewSandboxTestSdk.apk"/>
+        <option name="test-file-name" value="EmptySdkProviderApp.apk"/>
+        <option name="test-file-name" value="CtsSdkSandboxWebkitTestCases.apk"/>
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.AndroidJUnitTest">
+        <option name="package" value="android.sdksandbox.webkit.cts"/>
+        <option name="runtime-hint" value="6m39s"/>
+    </test>
+
+    <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
+        <option name="run-command" value="cmd sdk_sandbox set-state --enabled"/>
+        <option name="teardown-command" value="cmd sdk_sandbox set-state --reset"/>
+    </target_preparer>
+
+</configuration>
diff --git a/tests/tests/sdksandbox/webkit/OWNERS b/tests/tests/sdksandbox/webkit/OWNERS
new file mode 100644
index 0000000..e59f9b2
--- /dev/null
+++ b/tests/tests/sdksandbox/webkit/OWNERS
@@ -0,0 +1,2 @@
+# Bug component: 76427
+include /tests/tests/webkit/OWNERS
diff --git a/tests/tests/sdksandbox/webkit/sdksidetests/WebViewSandboxTest/Android.bp b/tests/tests/sdksandbox/webkit/sdksidetests/WebViewSandboxTest/Android.bp
new file mode 100644
index 0000000..d6f6b10
--- /dev/null
+++ b/tests/tests/sdksandbox/webkit/sdksidetests/WebViewSandboxTest/Android.bp
@@ -0,0 +1,35 @@
+// Copyright (C) 2022 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test_helper_app {
+    name: "WebViewSandboxTestSdk",
+    manifest: "AndroidManifest.xml",
+    certificate: ":sdksandbox-test",
+    srcs: [
+        "src/**/*.java",
+    ],
+    static_libs: [
+        "androidx.test.ext.junit",
+        "CtsSdkSandboxTestRunner",
+        "compatibility-device-util-axt",
+        "ctsdeviceutillegacy-axt",
+    ],
+    libs: [
+        "android.test.base",
+    ],
+}
diff --git a/tests/tests/sdksandbox/webkit/sdksidetests/WebViewSandboxTest/AndroidManifest.xml b/tests/tests/sdksandbox/webkit/sdksidetests/WebViewSandboxTest/AndroidManifest.xml
new file mode 100644
index 0000000..ed13f6ff
--- /dev/null
+++ b/tests/tests/sdksandbox/webkit/sdksidetests/WebViewSandboxTest/AndroidManifest.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  ~ Copyright (C) 2022 The Android Open Source Project
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          package="com.android.cts.sdksidetests.webviewsandboxtest">
+
+    <application>
+        <sdk-library android:name="com.android.cts.sdksidetests.webviewsandboxtest"
+                     android:versionMajor="1"/>
+        <property android:name="android.sdksandbox.PROPERTY_SDK_PROVIDER_CLASS_NAME"
+                  android:value="com.android.cts.sdksidetests.webviewsandboxtest.WebViewSandboxTestSdk"/>
+    </application>
+</manifest>
diff --git a/tests/tests/sdksandbox/webkit/sdksidetests/WebViewSandboxTest/src/com/android/cts/sdksidetests/webviewsandboxtest/WebViewSandboxTestSdk.java b/tests/tests/sdksandbox/webkit/sdksidetests/WebViewSandboxTest/src/com/android/cts/sdksidetests/webviewsandboxtest/WebViewSandboxTestSdk.java
new file mode 100644
index 0000000..7a1c827
--- /dev/null
+++ b/tests/tests/sdksandbox/webkit/sdksidetests/WebViewSandboxTest/src/com/android/cts/sdksidetests/webviewsandboxtest/WebViewSandboxTestSdk.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.cts.sdksidetests.webviewsandboxtest;
+
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.app.sdksandbox.testutils.testscenario.SdkSandboxTestScenarioRunner;
+import android.content.Context;
+import android.os.Bundle;
+import android.view.View;
+import android.webkit.WebView;
+
+import org.junit.Test;
+
+
+public class WebViewSandboxTestSdk extends SdkSandboxTestScenarioRunner {
+    private WebView mWebView;
+
+    @Override
+    public View beforeEachTest(Context windowContext, Bundle params, int width, int height) {
+        mWebView = new WebView(windowContext);
+        return mWebView;
+    }
+
+    @Test
+    public void testScrollBarOverlay() {
+        mWebView.setHorizontalScrollbarOverlay(true);
+        mWebView.setVerticalScrollbarOverlay(false);
+
+        assertThat(mWebView.overlayHorizontalScrollbar()).isTrue();
+        assertThat(mWebView.overlayVerticalScrollbar()).isFalse();
+    }
+}
diff --git a/tests/tests/sdksandbox/webkit/src/android/sdksandbox/webkit/cts/WebViewSandboxTest.java b/tests/tests/sdksandbox/webkit/src/android/sdksandbox/webkit/cts/WebViewSandboxTest.java
new file mode 100755
index 0000000..98295b7
--- /dev/null
+++ b/tests/tests/sdksandbox/webkit/src/android/sdksandbox/webkit/cts/WebViewSandboxTest.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.sdksandbox.webkit.cts;
+
+import android.app.sdksandbox.testutils.testscenario.KeepSdkSandboxAliveRule;
+import android.app.sdksandbox.testutils.testscenario.SdkSandboxScenarioRule;
+
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+
+import org.junit.ClassRule;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(AndroidJUnit4.class)
+public class WebViewSandboxTest {
+
+    @ClassRule
+    public static final KeepSdkSandboxAliveRule sSdkTestSuiteSetup = new KeepSdkSandboxAliveRule(
+            "com.android.emptysdkprovider");
+
+    @Rule
+    public final SdkSandboxScenarioRule sdkTester = new SdkSandboxScenarioRule(
+            "com.android.cts.sdksidetests.webviewsandboxtest");
+
+    @Test
+    public void testScrollBarOverlay() throws Exception {
+        sdkTester.assertSdkTestRunPasses("testScrollBarOverlay");
+    }
+}
diff --git a/tests/uwb/src/android/uwb/cts/RangingReportTest.java b/tests/uwb/src/android/uwb/cts/RangingReportTest.java
index b2524e7..5615689 100644
--- a/tests/uwb/src/android/uwb/cts/RangingReportTest.java
+++ b/tests/uwb/src/android/uwb/cts/RangingReportTest.java
@@ -20,12 +20,15 @@
 import static org.junit.Assert.fail;
 
 import android.os.Parcel;
+import android.os.PersistableBundle;
 import android.uwb.RangingMeasurement;
 import android.uwb.RangingReport;
 
 import androidx.test.ext.junit.runners.AndroidJUnit4;
 import androidx.test.filters.SmallTest;
 
+import com.google.uwb.support.oemextension.RangingReportMetadata;
+
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -41,19 +44,29 @@
     @Test
     public void testBuilder() {
         List<RangingMeasurement> measurements = UwbTestUtils.getRangingMeasurements(5);
+        long sessionId = 1;
+        byte[] rawNtf = new byte[]{0x01, 0x02, 0x02};
+        PersistableBundle rangingReportMetadata = new RangingReportMetadata.Builder()
+                .setSessionId(sessionId)
+                .setRawNtfData(rawNtf)
+                .build()
+                .toBundle();
 
         RangingReport.Builder builder = new RangingReport.Builder();
         builder.addMeasurements(measurements);
         RangingReport report = tryBuild(builder, true);
         verifyMeasurementsEqual(measurements, report.getMeasurements());
-
-
         builder = new RangingReport.Builder();
         for (RangingMeasurement measurement : measurements) {
             builder.addMeasurement(measurement);
         }
         report = tryBuild(builder, true);
         verifyMeasurementsEqual(measurements, report.getMeasurements());
+
+        builder.addRangingReportMetadata(rangingReportMetadata);
+        report = tryBuild(builder, true);
+
+        assertEquals(rangingReportMetadata, report.getRangingReportMetadata());
     }
 
     private void verifyMeasurementsEqual(List<RangingMeasurement> expected,