Fix intent redirect bypass via selector in addCreatorToken When evaluating whether to append a creator token to an intent in ActivityManagerService.addCreatorToken, the system calculates a targetPackage to determine if isCreatorSameAsTarget is true. If the creator and target match, the token is omitted since the intent is seemingly staying within the same application. However, the previous logic failed to inspect the intent's selector. An attacker could bypass the token injection by setting the outer intent's package to their own app (tricking isCreatorSameAsTarget into evaluating as true), while embedding a selector that explicitly targets a victim's component. The Android routing framework (ComputerEngine) evaluates the selector's explicit component and routes the intent to the victim, successfully delivering the payload without a creator token attached. This change fixes the targetPackage calculation to correctly account for selectors. It now prioritizes the explicit component of the outer intent, followed by the explicit component or package of the selector, and finally falls back to the outer intent's package constraint. Bug: 487147249 Test: Manually verifies the PoC of the vulnerability no longer works Flag: EXEMPT BUGFIX Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:dc03f183688231c065ac0e13ef10a00732ba7199 Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:acbde95f3eec1695d5bf4fa52e4153ef1d1a708a Merged-In: Idf5bdc7a5f9d1ca64b5504edc776685fd3bd3306 Change-Id: Idf5bdc7a5f9d1ca64b5504edc776685fd3bd3306
diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index 4e3bc09..e63c7c7b 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -21098,7 +21098,7 @@ String targetPackage = intent.getComponent() != null ? intent.getComponent().getPackageName() - : intent.getPackage(); + : null; final boolean isCreatorSameAsTarget = creatorPackage != null && creatorPackage.equals( targetPackage); final boolean noExtraIntentKeys =