)]}'
{
  "commit": "ba9c05f370430eeefd65c1b2c766891cc6248871",
  "tree": "0cbae58b2700e0e459fdb862edde83331c90d750",
  "parents": [
    "df4d44965279227a1ffb3bc4dbe63889c2f32575"
  ],
  "author": {
    "name": "Annie Lin",
    "email": "theannielin@google.com",
    "time": "Mon Mar 09 12:54:31 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 17:49:48 2026 -0700"
  },
  "message": "Harden startNextMatchingActivity() caller identity propagation.\n\nCurrently, startNextMatchingActivity propagates the original caller\u0027s identity to the next resolved activity. This enables an \"identity  squashing\" vulnerability where a malicious intermediary can trampoline an implicit intent from a privileged app to a victim app, bypassing permission checks (e.g. REQUEST_INSTALL_PACKAGES).\n\nThis change restricts identity forwarding to prevent caller ID spoofing. The original caller\u0027s identity (launchedFromPackage/launchedFromUid) is now only propagated if:\n1. The intermediary activity shares the same App ID as the original caller.\n2. The intermediary activity is a privileged system component (e.g. SYSTEM_UID), preserving expected behavior for system trampolines like ChooserActivity.\n\nIf these conditions are not met, the caller identity is safely reset to the intermediary\u0027s own UID and package name.\n\nBug: 471797575\nTest: atest WmTests:ActivityTaskManagerServiceTests\nTest: Verified via test app\nFlag: EXEMPT CVE_FIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:995f95376eb373d9e8d584883a87ebb90db609d0\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:a24b74da128da7cf45973c35154eb47876c3acf3\nMerged-In: I3df4b731bfae6ce6f8896c69ecdd118819057b36\nChange-Id: I3df4b731bfae6ce6f8896c69ecdd118819057b36\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c8e1e4d205dde4dcbb6052cff965daa488f863bb",
      "old_mode": 33188,
      "old_path": "core/java/android/app/Activity.java",
      "new_id": "3088317c80787afbb7a58dbf48c4879138bb8ad3",
      "new_mode": 33188,
      "new_path": "core/java/android/app/Activity.java"
    },
    {
      "type": "modify",
      "old_id": "bf2892d154ea80bec24d6ad6b3f9e3ce47198052",
      "old_mode": 33188,
      "old_path": "services/core/java/com/android/server/wm/ActivityTaskManagerService.java",
      "new_id": "4da626a126b8175764f4aa6ecac7630ed44e17df",
      "new_mode": 33188,
      "new_path": "services/core/java/com/android/server/wm/ActivityTaskManagerService.java"
    },
    {
      "type": "modify",
      "old_id": "4f94704ee39f8e2ecfb47e2045b21cafa06102bd",
      "old_mode": 33188,
      "old_path": "services/tests/wmtests/src/com/android/server/wm/ActivityTaskManagerServiceTests.java",
      "new_id": "33bcf909b33f3fba8510920bf164eb74c406f543",
      "new_mode": 33188,
      "new_path": "services/tests/wmtests/src/com/android/server/wm/ActivityTaskManagerServiceTests.java"
    },
    {
      "type": "modify",
      "old_id": "b512aa852ddb164df437310519cc65a6f7108cd7",
      "old_mode": 33188,
      "old_path": "services/tests/wmtests/src/com/android/server/wm/WindowTestsBase.java",
      "new_id": "d56fe050b9feb5662576ca29439c61c77d9b5f82",
      "new_mode": 33188,
      "new_path": "services/tests/wmtests/src/com/android/server/wm/WindowTestsBase.java"
    }
  ]
}