f44519d - platform/packages/apps/ContactsPicker

commit: f44519d86b51b3508f6fbfe93f5ee4baddd11069
[log]
author: Bhavuk Garg <bhavukgarg@google.com>
Tue Mar 31 12:00:00 2026 +0000
committer: Android Build Coastguard Worker <android-build-coastguard-worker@google.com>
Thu Jul 09 19:04:56 2026 -0700
tree: 3fa98d2b86629b08d0f317941f2982259503b19d
parent: 9ba93bf644c56a825a263cfd15f2161c17c6935b [diff]

Disable System Overlays to prevent tapjack attack

ContactsPickerActivity is not hiding overlay windows, allowing a malicious app with
SYSTEM_ALERT_WINDOW permission to hide privacy banner or show a custom message on top of
ContactsPicker page misleading user into giving access of contacts without full disclosure.
This change restricts overlay windows from being drawn on top of Contacts Picker to prevent
such attacks

Recording - http://b/488233632#attachment75003473

Bug: 488233632
Flag: EXEMPT CVE_FIX
Test: atest ContactsPickerIntegrationTests ContactsPickerComponentTests
(cherry picked from commit 9c389023fc9bd5bb84ad44a027e2737d81340cd0)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:aeb9081e881068a4cd584b81838efc36aa931c9b
Merged-In: Ia1a9d7f3ec3e924363c1617f5051f3fca7ded5a3
Change-Id: Ia1a9d7f3ec3e924363c1617f5051f3fca7ded5a3

3 files changed

tree: 3fa98d2b86629b08d0f317941f2982259503b19d