)]}'
{
  "commit": "e95170c6378e15695d5f8a3cfd39dfb76d8ff500",
  "tree": "42d79c080c51cddceb713ff5045a14f40607d3c6",
  "parents": [
    "a660d0c4648290b83f0570a521f772885ee6accb"
  ],
  "author": {
    "name": "Annie Lin",
    "email": "theannielin@google.com",
    "time": "Mon Mar 09 11:52:42 2026 -0800"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 18:24:17 2026 -0700"
  },
  "message": "Harden startNextMatchingActivity() caller identity propagation.\n\nCurrently, startNextMatchingActivity propagates the original caller\u0027s identity to the next resolved activity. This enables an \"identity  squashing\" vulnerability where a malicious intermediary can trampoline an implicit intent from a privileged app to a victim app, bypassing permission checks (e.g. REQUEST_INSTALL_PACKAGES).\n\nThis change restricts identity forwarding to prevent caller ID spoofing. The original caller\u0027s identity (launchedFromPackage/launchedFromUid) is now only propagated if:\n1. The intermediary activity shares the same App ID as the original caller.\n2. The intermediary activity is a privileged system component (e.g. SYSTEM_UID), preserving expected behavior for system trampolines like ChooserActivity.\n\nIf these conditions are not met, the caller identity is safely reset to the intermediary\u0027s own UID and package name.\n\nBug: 471797575\nTest: atest WmTests:ActivityTaskManagerServiceTests\nTest: Verified via test app\nFlag: EXEMPT CVE_FIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:995f95376eb373d9e8d584883a87ebb90db609d0\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:2b02232721942885bb45f9c72e2b70200e433c1d\nMerged-In: I3df4b731bfae6ce6f8896c69ecdd118819057b36\nChange-Id: I3df4b731bfae6ce6f8896c69ecdd118819057b36\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c129fde3f81916e3ed4e2e67b77bfeac2288a1dc",
      "old_mode": 33188,
      "old_path": "core/java/android/app/Activity.java",
      "new_id": "1a3ea4b47d840374c6b32786209eefce2944a96e",
      "new_mode": 33188,
      "new_path": "core/java/android/app/Activity.java"
    },
    {
      "type": "modify",
      "old_id": "a7f1265ac4fd172fbb5b7f2c5cdafd238b6083a4",
      "old_mode": 33188,
      "old_path": "services/core/java/com/android/server/wm/ActivityTaskManagerService.java",
      "new_id": "b2cf2d87ebd5fc030acd9f06bf00c233a48900ad",
      "new_mode": 33188,
      "new_path": "services/core/java/com/android/server/wm/ActivityTaskManagerService.java"
    },
    {
      "type": "modify",
      "old_id": "ec264034871a9bc4a98184110d835fdf941e6bf7",
      "old_mode": 33188,
      "old_path": "services/tests/wmtests/src/com/android/server/wm/ActivityTaskManagerServiceTests.java",
      "new_id": "984c2957fc4a94766d539e851287187a0607f2d9",
      "new_mode": 33188,
      "new_path": "services/tests/wmtests/src/com/android/server/wm/ActivityTaskManagerServiceTests.java"
    },
    {
      "type": "modify",
      "old_id": "471b065aebb4fb4364f4d663553e52e7ef711323",
      "old_mode": 33188,
      "old_path": "services/tests/wmtests/src/com/android/server/wm/WindowTestsBase.java",
      "new_id": "8c97604deda4055512033dcaf526cc462dd59b58",
      "new_mode": 33188,
      "new_path": "services/tests/wmtests/src/com/android/server/wm/WindowTestsBase.java"
    }
  ]
}