)]}'
{
  "commit": "ee7ea482d39e1fa263e83b5452376d7c7c79f81a",
  "tree": "e75c4af77da891764d9e011aedd0c722a0828569",
  "parents": [
    "110da4cfe2a84413cb7d1a8786d77fcb1bee34fe"
  ],
  "author": {
    "name": "Nan Wu",
    "email": "wnan@google.com",
    "time": "Wed Apr 01 10:49:39 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 19:00:24 2026 -0700"
  },
  "message": "Fix intent redirect bypass via selector in addCreatorToken\n\n  When evaluating whether to append a creator token to an intent in\n  ActivityManagerService.addCreatorToken, the system calculates a\n  targetPackage to determine if isCreatorSameAsTarget is true. If\n  the creator and target match, the token is omitted since the intent\n  is seemingly staying within the same application.\n\n  However, the previous logic failed to inspect the intent\u0027s selector.\n  An attacker could bypass the token injection by setting the outer\n  intent\u0027s package to their own app (tricking isCreatorSameAsTarget\n  into evaluating as true), while embedding a selector that explicitly\n  targets a victim\u0027s component. The Android routing framework\n  (ComputerEngine) evaluates the selector\u0027s explicit component and\n  routes the intent to the victim, successfully delivering the payload\n  without a creator token attached.\n\n  This change fixes the targetPackage calculation to correctly account\n  for selectors. It now prioritizes the explicit component of the outer\n  intent, followed by the explicit component or package of the selector,\n  and finally falls back to the outer intent\u0027s package constraint.\n\nBug: 487147249\nTest: Manually verifies the PoC of the vulnerability no longer works\nFlag: EXEMPT BUGFIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:dc03f183688231c065ac0e13ef10a00732ba7199\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:acbde95f3eec1695d5bf4fa52e4153ef1d1a708a\nMerged-In: Idf5bdc7a5f9d1ca64b5504edc776685fd3bd3306\nChange-Id: Idf5bdc7a5f9d1ca64b5504edc776685fd3bd3306\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "4e3bc096a8ca5ab849550505738ddc6978fae64a",
      "old_mode": 33188,
      "old_path": "services/core/java/com/android/server/am/ActivityManagerService.java",
      "new_id": "e63c7c7b97b53207414bfcb9726de2aedd530d53",
      "new_mode": 33188,
      "new_path": "services/core/java/com/android/server/am/ActivityManagerService.java"
    }
  ]
}