Fix PendingIntent hijacking for adb notifications.
Use an explicit intent and set PendingIntent.FLAG_IMMUTABLE to prevent someone from modifying the intent from PendingIntent.send(...). Bug: 153356209 Test: atest AdbNotificationsTest Test: In bug, install and launch the PoC apk and give it notification permissions. Then, with USB/Wifi debugging enabled, disconnect and connect the device to create the adb notification. the PoC apk should not have permission to display information from content://com.android.settings.files/my_cache/NOTICE.html. Change-Id: Ie49aa3cf9b33168cf1435fc2427e95aac7f4609b (cherry picked from commit 2c038814) Exempt-From-Owner-Approval: approved in master
Loading
Please register or sign in to comment