)]}'
{
  "commit": "bb74132474550c7e497ecd8a906544c08561b59c",
  "tree": "2897c22fc5cb814284cd7762f03d50325aa9ac26",
  "parents": [
    "20ecd72dd4c83f4fd964ae4dbd2e4e85d572e0f0"
  ],
  "author": {
    "name": "Annie Lin",
    "email": "theannielin@google.com",
    "time": "Mon Mar 09 10:31:40 2026 -0800"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 15:43:05 2026 -0700"
  },
  "message": "Harden startNextMatchingActivity() caller identity propagation.\n\nCurrently, startNextMatchingActivity propagates the original caller\u0027s identity to the next resolved activity. This enables an \"identity  squashing\" vulnerability where a malicious intermediary can trampoline an implicit intent from a privileged app to a victim app, bypassing permission checks (e.g. REQUEST_INSTALL_PACKAGES).\n\nThis change restricts identity forwarding to prevent caller ID spoofing. The original caller\u0027s identity (launchedFromPackage/launchedFromUid) is now only propagated if:\n1. The intermediary activity shares the same App ID as the original caller.\n2. The intermediary activity is a privileged system component (e.g. SYSTEM_UID), preserving expected behavior for system trampolines like ChooserActivity.\n\nIf these conditions are not met, the caller identity is safely reset to the intermediary\u0027s own UID and package name.\n\nBug: 471797575\nTest: atest WmTests:ActivityTaskManagerServiceTests\nTest: Verified via test app\nFlag: EXEMPT CVE_FIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:995f95376eb373d9e8d584883a87ebb90db609d0\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:403e243464c20646b33c3b925863e9f4763ef798\nMerged-In: I3df4b731bfae6ce6f8896c69ecdd118819057b36\nChange-Id: I3df4b731bfae6ce6f8896c69ecdd118819057b36\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8021ce0dc20d7e7883a974a1336b18b685de5fc1",
      "old_mode": 33188,
      "old_path": "core/java/android/app/Activity.java",
      "new_id": "ad2b39d01b2d508f8fcbea6d7ba58b35709285d8",
      "new_mode": 33188,
      "new_path": "core/java/android/app/Activity.java"
    },
    {
      "type": "modify",
      "old_id": "a100450dc8492ad4b4c8c9a1be961b4c604db89a",
      "old_mode": 33188,
      "old_path": "services/core/java/com/android/server/wm/ActivityTaskManagerService.java",
      "new_id": "6194678bbbbcf3c6e17c56e87e8e95cd7e5ee0b2",
      "new_mode": 33188,
      "new_path": "services/core/java/com/android/server/wm/ActivityTaskManagerService.java"
    },
    {
      "type": "modify",
      "old_id": "4290f4b9ee80b9d38d7a4cb8e7b7fc6de060e6ae",
      "old_mode": 33188,
      "old_path": "services/tests/wmtests/src/com/android/server/wm/ActivityTaskManagerServiceTests.java",
      "new_id": "1cfc759906568c7541cc78183cf35c79ba70eb54",
      "new_mode": 33188,
      "new_path": "services/tests/wmtests/src/com/android/server/wm/ActivityTaskManagerServiceTests.java"
    },
    {
      "type": "modify",
      "old_id": "29b4d2680846d084137a69d52d9a244198ebed36",
      "old_mode": 33188,
      "old_path": "services/tests/wmtests/src/com/android/server/wm/WindowTestsBase.java",
      "new_id": "9655fb9158137a375d31f64620987ff2f46f12d1",
      "new_mode": 33188,
      "new_path": "services/tests/wmtests/src/com/android/server/wm/WindowTestsBase.java"
    }
  ]
}