Make mutable implicit PendingIntent immutable
Starting from target SDK U, we will block creation of mutable PendingIntents with implicit Intents because attackers can mutate the Intent object within and launch altered behavior on behalf of victim apps. For more details on the vulnerability, see go/pendingintent-rca. From a quick analysis, we concluded that the PendingIntent here is only mutated with flags from fillInIntent, so we added them to the intent inside and made the PendingIntent immutable. Reviewers, please call out if this is not the case. Bug: 236704164 Bug: 229362273 Test: CtsVerifier: Bubble Notification Tests Test: atest frameworks/base/libs/WindowManager/Shell/tests/unittest/src/com/android/wm/shell/bubbles Change-Id: Idda5868f193070908afd435cedac72a03b6c4439
Loading
Please register or sign in to comment