)]}'
{
  "commit": "b8e217c4e6cd732b12359d880882a3a45923cf51",
  "tree": "5d759fde6cb95c51cab8570aab8163b4cd3c37c3",
  "parents": [
    "6acdd7f1a72dcfed0ada404be142a7b40f68f93a"
  ],
  "author": {
    "name": "Himanshu Gupta",
    "email": "himanshuz@google.com",
    "time": "Tue May 05 17:00:48 2026 +0100"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 19:03:38 2026 -0700"
  },
  "message": "Fix BAL bypass via getAppMarketActivityIntent\n\nLauncherAppsService.getAppMarketActivityIntent created a PendingIntent\non behalf of the system server (UID 1000) due to cleared identity.\nAn unprivileged app could request this IntentSender and use it as\na deleteIntent in a notification, allowing it to launch activities\nfrom the background when the notification is dismissed, bypassing\nBAL restrictions.\n\nThis fix sets the PendingIntentCreatorBackgroundActivityStartMode to\nALLOW_IF_VISIBLE when creating the PendingIntent. This ensures that\nthe PendingIntent carries restrictions that prevent background activity\nlaunches unless the app is visible, while still allowing the system\nserver to create the PendingIntent (preserving cross-profile functionality).\n\nBug: 492867206\nTest: atest CtsPackageManagerTestCases:android.content.pm.cts.LauncherAppsForHiddenProfilesTest\nFlag: EXEMPT CVE_FIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:0c7caef3e68dc331a45cad0b6bbee69e7cf928ba\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:927fb5e35c9d7b1808d72c9ac6ba3b049fd73428\nMerged-In: Ida112cd1f289089c4dba4c81d5cd43496daeeb62\nChange-Id: Ida112cd1f289089c4dba4c81d5cd43496daeeb62\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9980ac7b3d09b9a44a12ce57483b22d0334255f2",
      "old_mode": 33188,
      "old_path": "services/core/java/com/android/server/pm/LauncherAppsService.java",
      "new_id": "7f023d9919390d43e0fb1bca8668189f26406c23",
      "new_mode": 33188,
      "new_path": "services/core/java/com/android/server/pm/LauncherAppsService.java"
    }
  ]
}