{ "month": "2023-11", "generated": "2026-10-06T12:05+00:00", "majors": { "14": { "counts": { "announced": 9, "certain": 9, "probable": 0, "not_published": 0, "not_covered": 0, "awaiting": 0 }, "advisories": [ { "cve": "CVE-2023-40100", "osv_id": "ASB-A-278303745", "source": "osv", "announced": "2023-11-01", "severity": "High", "types": [ "EoP" ], "status": "resolved", "brief": { "summary": "Makes Dns64Configuration reference counted (RefBase) and has the detached DNS64 prefix discovery thread capture a strong pointer (sp) to it instead of a raw this, so the object outlives the thread; ResolverController now owns it through android::sp.", "confidence": "high", "backport_notes": [ "This is a single commit, but all of its parts must be applied together: the RefBase inheritance, sp::make ownership in ResolverController, the thiz capture in startPrefixDiscovery, and the libutils additions in Android.bp and tests/Android.bp (including the fuzzer cc_defaults for android and host). DnsResolver is a mainline module (general platform knowledge)." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 6, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "method": [ "bug_id" ], "confidence": "certain", "first_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "last_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "public_commits": [ { "project": "platform/packages/modules/DnsResolver", "sha": "de58649ab30a19d8d629141d914677d621628c78", "tag": "android-security-14.0.0_r2", "provenance": "security_tag", "method": "bug_id", "confidence": "certain", "evidence": null, "similarity": null } ], "n_public_commits": 1, "projects": [ "platform/packages/modules/DnsResolver" ] }, { "cve": "CVE-2023-40105", "osv_id": "ASB-A-289549315", "source": "osv", "announced": "2023-11-01", "severity": "High", "types": [ "ID" ], "status": "resolved", "brief": { "summary": "Adds a check to ActivityManagerService.backupAgentCreated() that compares the caller's uid with the package's uid, so a caller can only report a backup agent for a package that belongs to its own uid.", "confidence": "high", "backport_notes": [ "The patch is self-contained in ActivityManagerService.java. It depends on getPackageManagerInternal() and PackageManagerInternal.getPackageUid(String, flags, userId). On older branches, confirm that the local signature accepts the flags argument (general platform knowledge)." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 7, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "method": [ "bug_id" ], "confidence": "certain", "first_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "last_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "public_commits": [ { "project": "platform/frameworks/base", "sha": "06830ff04faaf34f61cce103e0a90338f220c920", "tag": "android-security-14.0.0_r2", "provenance": "security_tag", "method": "bug_id", "confidence": "certain", "evidence": null, "similarity": null } ], "n_public_commits": 1, "projects": [ "platform/frameworks/base" ] }, { "cve": "CVE-2023-40106", "osv_id": "ASB-A-278558814", "source": "osv", "announced": "2023-11-01", "severity": "High", "types": [ "EoP" ], "status": "resolved", "brief": { "summary": "Replaces Notification.setAllowlistToken(null) with a new clearAllowlistToken() that also nulls the allowlist token on the nested publicVersion Notification before NotificationManagerService returns an app's own notifications to it.", "confidence": "high", "backport_notes": [ "Single commit, two files. When backporting, rename every caller of the @hide Notification.setAllowlistToken(IBinder) (only sanitizeSbn appears in the diff) or keep the old setter alongside clearAllowlistToken(). On trees that already use overrideAllowlistToken(null), check that this method also clears publicVersion, since the material does not show its body." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 5, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "method": [ "bug_id" ], "confidence": "certain", "first_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "last_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "public_commits": [ { "project": "platform/frameworks/base", "sha": "7ac1135a7f857d40e125ba591a0ef005d5e00969", "tag": "android-security-14.0.0_r2", "provenance": "security_tag", "method": "bug_id", "confidence": "certain", "evidence": null, "similarity": null } ], "n_public_commits": 1, "projects": [ "platform/frameworks/base" ] }, { "cve": "CVE-2023-40107", "osv_id": "ASB-A-287298721", "source": "osv", "announced": "2023-11-01", "severity": "High", "types": [ "EoP" ], "status": "resolved", "brief": { "summary": "Adds `mVPSBuf = NULL;` to the single-argument `ARTPWriter::ARTPWriter(int fd)` constructor in media/libstagefright/rtsp/ARTPWriter.cpp. Before this, the VPS buffer pointer was left uninitialised while mSPSBuf and mPPSBuf next to it were already initialised.", "confidence": "high", "backport_notes": [ "A single self-contained one-line change with no dependencies: add it next to the existing `mSPSBuf = NULL;` in `ARTPWriter::ARTPWriter(int fd)`. When backporting, also check whether the six-argument constructor in the same file initialises mVPSBuf, since its body is not shown in the material." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 4, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "method": [ "bug_id" ], "confidence": "certain", "first_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "last_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "public_commits": [ { "project": "platform/frameworks/av", "sha": "1a233e80bc311213504544a31144576e46dab298", "tag": "android-security-14.0.0_r2", "provenance": "security_tag", "method": "bug_id", "confidence": "certain", "evidence": null, "similarity": null } ], "n_public_commits": 1, "projects": [ "platform/frameworks/av" ] }, { "cve": "CVE-2023-40109", "osv_id": "ASB-A-291299076", "source": "osv", "announced": "2023-11-01", "severity": "High", "types": [ "EoP" ], "status": "resolved", "brief": { "summary": "UsbConfiguration.CREATOR.createFromParcel now uses the type-safe Parcel.readParcelableArray(ClassLoader, Class) overload with UsbInterface.class, so a non-UsbInterface element in the interfaces array is rejected when a UsbConfiguration is unparceled.", "confidence": "high", "backport_notes": [ "Single small change in one file (2 insertions, 1 deletion), no other commits involved; check that the target branch provides the typed readParcelableArray(ClassLoader, Class) overload before applying as-is." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 6, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "method": [ "bug_id" ], "confidence": "certain", "first_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "last_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "public_commits": [ { "project": "platform/frameworks/base", "sha": "d8d48d8689f8f7bace3f8ddd0f96dbaac8b2712b", "tag": "android-security-14.0.0_r2", "provenance": "security_tag", "method": "bug_id", "confidence": "certain", "evidence": null, "similarity": null } ], "n_public_commits": 1, "projects": [ "platform/frameworks/base" ] }, { "cve": "CVE-2023-40110", "osv_id": "ASB-A-243463593", "source": "osv", "announced": "2023-11-01", "severity": "High", "types": [ "EoP" ], "status": "resolved", "brief": { "summary": "Adds bounds checks against mBufferSize to MtpPacket::getUInt16, getUInt32, putUInt16 and putUInt32 in media/mtp/MtpPacket.cpp, so reads abort and writes are dropped when offset plus field width exceeds the allocated buffer.", "confidence": "high", "backport_notes": [ "Single commit touching only media/mtp/MtpPacket.cpp. It uses only the existing mBuffer/mBufferSize members of MtpPacket. The material does not show whether it applies cleanly to the older affected branches (11, 12, 12L, 13).", "The policy is asymmetric: reads abort(), writes only log. The else branches of getUInt16/getUInt32 have no return statement and rely on abort() not returning." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 5, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "method": [ "bug_id" ], "confidence": "certain", "first_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "last_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "public_commits": [ { "project": "platform/frameworks/av", "sha": "ce7ba619260d8e4a8b75fd999be629ef941dd9cc", "tag": "android-security-14.0.0_r2", "provenance": "security_tag", "method": "bug_id", "confidence": "certain", "evidence": null, "similarity": null } ], "n_public_commits": 1, "projects": [ "platform/frameworks/av" ] }, { "cve": "CVE-2023-40111", "osv_id": "ASB-A-272024837", "source": "osv", "announced": "2023-11-01", "severity": "High", "types": [ "EoP" ], "status": "resolved", "brief": { "summary": "The media session service's setMediaButtonReceiver now logs and ignores PendingIntents that target an activity, so a media button receiver can no longer be used to bypass background activity launch restrictions.", "confidence": "high", "backport_notes": [ "Single commit. The server-side check depends only on PendingIntent.isActivity() and the existing SESSION_POLICY_IGNORE_BUTTON_RECEIVER early return in MediaSessionRecord's setMediaButtonReceiver. The enforcement itself is in that server-side check; the client-side part changes the documentation and swaps Log.wtf for rethrowFromSystemServer." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 3, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "method": [ "bug_id" ], "confidence": "certain", "first_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "last_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "public_commits": [ { "project": "platform/frameworks/base", "sha": "55d3d57cbffc838c52d610af14a056dea87b422e", "tag": "android-security-14.0.0_r2", "provenance": "security_tag", "method": "bug_id", "confidence": "certain", "evidence": null, "similarity": null } ], "n_public_commits": 1, "projects": [ "platform/frameworks/base" ] }, { "cve": "CVE-2023-40114", "osv_id": "ASB-A-243381410", "source": "osv", "announced": "2023-11-01", "severity": "High", "types": [ "EoP" ], "status": "resolved", "brief": { "summary": "Adds a mutex, condition variable and atomic child-thread counter to MtpFfsHandle so that close() waits (up to 2 seconds) for detached doSendEvent threads spawned by sendEvent() to finish before the handle is torn down, preventing a heap use-after-free of the handle's members from the detached thread.", "confidence": "high", "backport_notes": [ "Single self-contained commit touching only MtpFfsHandle.cpp/.h; it needs , , and to be available (the diff does not show added includes, so verify it compiles on the target branch). The bulletin also lists 11, 12, 12L and 13 as affected; the material does not show those branches' code, so check that sendEvent()/doSendEvent() have the same detached-thread structure before applying." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 4, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "method": [ "bug_id" ], "confidence": "certain", "first_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "last_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "public_commits": [ { "project": "platform/frameworks/av", "sha": "1deb1302cfcc4b9660baf822fc9177adaeac09a7", "tag": "android-security-14.0.0_r2", "provenance": "security_tag", "method": "bug_id", "confidence": "certain", "evidence": null, "similarity": null } ], "n_public_commits": 1, "projects": [ "platform/frameworks/av" ] }, { "cve": "CVE-2023-40115", "osv_id": "ASB-A-285645039", "source": "osv", "announced": "2023-11-01", "severity": "High", "types": [ "EoP" ], "status": "resolved", "brief": { "summary": "Replaces the detached log-reader thread spawned in the StatsService constructor with a class-member std::thread. The thread is told to stop (an atomic flag plus a wake-up event pushed into the queue) and joined in the StatsService destructor, so readLogs() can no longer run against a destroyed StatsService.", "confidence": "high", "backport_notes": [ "This is a single self-contained commit touching only StatsService.cpp and StatsService.h. It uses LogEventQueue `waitPop()` and `push(std::unique_ptr, int64_t*)` and a `LogEvent(uid, pid)` constructor, so check those signatures on the target branch.", "At r29 the destructor also calls onStatsdInitCompletedHandlerTermination(). That call is not part of this commit." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 7, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "method": [ "bug_id" ], "confidence": "certain", "first_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "last_fix": { "tag": "android-security-14.0.0_r2", "date": "2023-11-06", "provenance": "security_tag" }, "public_commits": [ { "project": "platform/packages/modules/StatsD", "sha": "f6a9ca981b93b747f12b7e0fa5fa5aa6da050cd2", "tag": "android-security-14.0.0_r2", "provenance": "security_tag", "method": "bug_id", "confidence": "certain", "evidence": null, "similarity": null } ], "n_public_commits": 1, "projects": [ "platform/packages/modules/StatsD" ] } ], "tags": [ "android-security-14.0.0_r2" ], "unannounced": [ { "bug_ids": [ "281550232" ], "commits": [ { "project": "device/generic/goldfish", "sha": "d11899bb015a5b6e2aa8b5628af661ab7bb4510c", "subject": "Output fake correlation vectors if requested", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "236031741" ], "commits": [ { "project": "device/generic/goldfish", "sha": "7d825dc822c9af4c7b82a52e8f911c5207d58cd1", "subject": "Remove hardware identity service from TVs", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "281550510", "286856907" ], "commits": [ { "project": "device/generic/goldfish-opengl", "sha": "63dd02e53bee711a72f741b46adae887276c8827", "subject": "codecs: check client usage flags for decoder", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "295937899" ], "commits": [ { "project": "device/google/barbet", "sha": "94026f7bf347e50d4cfd28fe55fb6bc9ebc53bf2", "subject": "Update barbet SVN to 48", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/barbet", "sha": "c67cdffbb506d02132007ce9c3943b2f8d3dbc30", "subject": "Update barbet SVN to 46", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/bluejay", "sha": "0ea630f587f28bc352d536d1b532273e78a406c5", "subject": "Update bluejay SVN to 47", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/bluejay", "sha": "620a6776c0842765de4f3bbb9f195e39b5865efd", "subject": "Update bluejay SVN to 47", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/bluejay", "sha": "69d65fa1d10b8b231d56cd5b29d09a28de1b11e1", "subject": "Update bluejay SVN to 47", "tag": "android-security-14.0.0_r2", "merged": "2023-08-23", "markers": [] }, { "project": "device/google/bluejay", "sha": "b407050b069bef12b73d97e5d0262a3d62235ded", "subject": "Update bluejay SVN to 47", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/bluejay", "sha": "97d316e7d6f5e5501886acaf74ad89c7e4488596", "subject": "Update bluejay SVN to 46", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/felix", "sha": "c76769f812e222424e563e188e80136035c75f14", "subject": "Update felix SVN to 25", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/felix", "sha": "eb6f4a6efd1a1a580536203566fd595b1ca8b8c0", "subject": "Update felix SVN to 25", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/felix", "sha": "9d2c9c3ee445db3def5a31ecef9dacbac3bc85d6", "subject": "Update felix SVN to 25", "tag": "android-security-14.0.0_r2", "merged": "2023-08-23", "markers": [] }, { "project": "device/google/felix", "sha": "b958006515a627c48c4896cad3baf80495d37914", "subject": "Update felix SVN to 25", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/felix", "sha": "ce96371fc2740034e72629b1355bb95f8e467e6c", "subject": "Update felix SVN to 24", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/lynx", "sha": "f34a8693061f0516ccd97c3621bae94d21519dd1", "subject": "Update lynx SVN to 17", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/lynx", "sha": "bff662971bc2adb9d9d2544d0c1b36008792580b", "subject": "Update lynx SVN to 17", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/lynx", "sha": "e62accf52118ebd1e203980a18aff04724454ce7", "subject": "Update lynx SVN to 17", "tag": "android-security-14.0.0_r2", "merged": "2023-08-23", "markers": [] }, { "project": "device/google/lynx", "sha": "9f9b5e4b402e6b21a1352a96f50aeb2f2dc1740b", "subject": "Update lynx SVN to 17", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/lynx", "sha": "65490d791d5da1277ed92f769b95c48787d85211", "subject": "Update lynx SVN to 16", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/pantah", "sha": "254fd674a19777aaa9ba849207af0be9ebd323ea", "subject": "Update panther SVN to 32", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/pantah", "sha": "7cbb9f04e927a3b636e621e4ebcdaf0bd963494d", "subject": "Update cheetah SVN to 32", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/pantah", "sha": "dedb943acdd8d5c3a1289481a3c922a80a0f4c54", "subject": "Update panther SVN to 32", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/pantah", "sha": "66b7ebc849390ea60ae85c8d540f205f9fec07c1", "subject": "Update cheetah SVN to 32", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/pantah", "sha": "c1eba80c111bc935261839b63868955ae3c641c7", "subject": "Update panther SVN to 32", "tag": "android-security-14.0.0_r2", "merged": "2023-08-23", "markers": [] }, { "project": "device/google/pantah", "sha": "93811f9b9ae8958087e062cdc1e3a0c6227ad365", "subject": "Update cheetah SVN to 32", "tag": "android-security-14.0.0_r2", "merged": "2023-08-23", "markers": [] }, { "project": "device/google/pantah", "sha": "09d77b7c7308ac85f8c63fbf000c7516668f2656", "subject": "Update panther SVN to 32", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/pantah", "sha": "c8577dbf14490f8a006d948a362d374f74c2587a", "subject": "Update cheetah SVN to 32", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/pantah", "sha": "182b9db73618210e4f291b1a82ca7f181e862887", "subject": "Update cheetah SVN to 31", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/pantah", "sha": "9ebb83dc98772fc2b6d77419ae3d13e74fb5aa07", "subject": "Update panther SVN to 31", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/raviole", "sha": "72fd8871aa292a74e9127a0f2a99fc174280650b", "subject": "Update oriole SVN to 68", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/raviole", "sha": "4793fddc60bdf47d23db94cbe0fd204bd89fcb6a", "subject": "Update raven SVN to 68", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/raviole", "sha": "275d5052d8aed2fb3f2dc1bbc5fb3a5d01e4a233", "subject": "Update oriole SVN to 68", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/raviole", "sha": "5f649c76a0776ecfb6e3ad883cfca78a3316b892", "subject": "Update raven SVN to 68", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/raviole", "sha": "3b58a31c1119b1fd75865de5987aa2bd3d97d40d", "subject": "Update oriole SVN to 68", "tag": "android-security-14.0.0_r2", "merged": "2023-08-23", "markers": [] }, { "project": "device/google/raviole", "sha": "8818ce47654a0fa8e20f439f32778a11a37faf5b", "subject": "Update raven SVN to 68", "tag": "android-security-14.0.0_r2", "merged": "2023-08-23", "markers": [] }, { "project": "device/google/raviole", "sha": "4d6bdda1cd18df90cf8b9510eaaf33d8ab34ec3c", "subject": "Update oriole SVN to 68", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/raviole", "sha": "fab6942368d864bd92341b9fe57f1b1123c066fe", "subject": "Update raven SVN to 68", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/raviole", "sha": "8b34cd2c23192c5cc08671f2e5e7c4cfbaf0affa", "subject": "Update raven SVN to 67", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/raviole", "sha": "469922edf5a4633ebdd84c8a5a7646ae519bb858", "subject": "Update oriole SVN to 67", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/redbull", "sha": "cbe8968d19414613a31196b999ec27c3ce561000", "subject": "Update redbull SVN to 74", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/redbull", "sha": "91a98a59f44d3e863bfb5829246358693a1c31e7", "subject": "Update redbull SVN to 72", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "platform/build", "sha": "c94178c9f641a56438f3aa8dcd2000af43025845", "subject": "Update Security String to 2023-10-05", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289414927" ], "commits": [ { "project": "device/google/barbet", "sha": "388dfbc1c0a3bd791098de0ff9d7de0c461bf288", "subject": "Update barbet SVN to 47", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/barbet", "sha": "3a40ce81ed93a1a680714e5a9c66d7155974d453", "subject": "Update barbet SVN to 45", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/bluejay", "sha": "38bb33ab98ab5b634180110562eb98d1a450c062", "subject": "Update bluejay SVN to 45", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/bluejay", "sha": "606df2388a7bd2a7603f917a55ac710617363cfb", "subject": "Update bluejay SVN to 45", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "device/google/bluejay", "sha": "40b8836aeb66cc76f931aadd79233ffea7d29d47", "subject": "Update bluejay SVN to 45", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/bluejay", "sha": "c8d423966956a2aebef35fa8a237766ad2c70532", "subject": "Update bluejay SVN to 44", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/bluejay", "sha": "85067e5c12fd46086d902a9776c3dcd85c52db0b", "subject": "Update bluejay SVN to 43", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/bluejay", "sha": "cbc72288755d5a3043407dc349c41b7e64fce109", "subject": "Update bluejay SVN to 43", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "device/google/bluejay", "sha": "aa6d68978aa275882e958a287073d263ce4be0ec", "subject": "Update bluejay SVN to 42", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/felix", "sha": "c506f0cddd69c62cf15368310eb2724e01e598bf", "subject": "Update felix SVN to 23", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/felix", "sha": "755154d6d47fe5f7e45304db83a2e46f9bb2f111", "subject": "Update felix SVN to 22", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/felix", "sha": "fc2ed141fe83627defd42018894087b0827567bb", "subject": "Update felix SVN to 23", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "device/google/felix", "sha": "88f0b8a1024b3e587d806f40a6339370393f2b76", "subject": "Update felix SVN to 22", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "device/google/felix", "sha": "21b1943eb005e8b578af8409599bae38824814fb", "subject": "Update felix SVN to 22", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "device/google/felix", "sha": "8a804d7012421f0c17d90f422a436cdc67f96382", "subject": "Update felix SVN to 23", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/felix", "sha": "da7b44023143309997a7bfb05c1b66ed653b4d0e", "subject": "Update felix SVN to 22", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/felix", "sha": "3eca26b6a70e7b95f63d0b57e12c69374e8296f7", "subject": "Update felix SVN to 22", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/felix", "sha": "5c1deed09f2a3a9d37b26a27f622ab4253ad942d", "subject": "Update felix SVN to 21", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/felix", "sha": "1bcf28495ae1cbb9aa50d89a47d63d3a8a54a6d6", "subject": "Revert \"Revert \"Update felix SVN to 21\"\"", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "device/google/felix", "sha": "b96cf63bba751d1c17b90400fdcd4eaa2303c7b9", "subject": "Revert \"Revert \"Update felix SVN to 21\"\"", "tag": "android-security-14.0.0_r2", "merged": "2023-08-06", "markers": [] }, { "project": "device/google/felix", "sha": "9407daa064af641020e9e1250ec42ce2ecb31932", "subject": "Revert \"Update felix SVN to 21\"", "tag": "android-security-14.0.0_r2", "merged": "2023-08-03", "markers": [] }, { "project": "device/google/felix", "sha": "35d0c6ce8ffca29b375d592cec9552d5b2670195", "subject": "Update felix SVN to 21", "tag": "android-security-14.0.0_r2", "merged": "2023-07-29", "markers": [] }, { "project": "device/google/felix", "sha": "a38c59118f1534fc697c0db85b15972195c57c76", "subject": "Update felix SVN to 20", "tag": "android-security-14.0.0_r2", "merged": "2023-07-12", "markers": [] }, { "project": "device/google/felix", "sha": "c6c9da6c90206d8c24c23a1c1312ecce3ffa95ab", "subject": "Update felix SVN to 19", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/lynx", "sha": "926a265425c541edb9b1ff09d9e9be71f5c6c3fc", "subject": "Update lynx SVN to 15", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/lynx", "sha": "1f4d52a4ab5769b167bd9f093fc9fef675e45ce4", "subject": "Update lynx SVN to 15", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "device/google/lynx", "sha": "a09cd830e1c5d3f6bad9b3cff6fd77f81c7a45e5", "subject": "Update lynx SVN to 15", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/lynx", "sha": "c632b3404575b9c9980b7719f513de77fd8b6f5e", "subject": "Update lynx SVN to 14", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/lynx", "sha": "8713880edf17436eb8195cb878b311668b44c243", "subject": "Update lynx SVN to 13", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/lynx", "sha": "2fba189428095d0943fc10ede5671be013fae2d0", "subject": "Update lynx SVN to 13", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "device/google/lynx", "sha": "6f4f9bf95ea40d28cf86f3d8f42ce2cc7307b228", "subject": "Update lynx SVN to 13", "tag": "android-security-14.0.0_r2", "merged": "2023-08-06", "markers": [] }, { "project": "device/google/lynx", "sha": "4766ddbc2b2021e9a7607fade3fc1f7c85a068d8", "subject": "Update lynx SVN to 12", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/pantah", "sha": "0f9ef1b294fd1161b379e4ba02ae16964d7d3d17", "subject": "Update panther SVN to 30", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/pantah", "sha": "a5401dbe46a0e45cbfea41a906cc05d537e01d7e", "subject": "Update cheetah SVN to 30", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/pantah", "sha": "1f3947c69ce15304225a36191dfeb67e4c74a1ae", "subject": "Update panther SVN to 30", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "device/google/pantah", "sha": "11191a4102277d501b680ad9e4a46c7c224ce5fb", "subject": "Update cheetah SVN to 30", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "device/google/pantah", "sha": "a1424fd67623e09096a73401d99844399eb1957d", "subject": "Update panther SVN to 30", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/pantah", "sha": "ce4c12ed111121cb2e20d2509428e11ef53d2d57", "subject": "Update cheetah SVN to 30", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/pantah", "sha": "4870fda0e12d9240d26b20fd60c814130550fe55", "subject": "Update cheetah SVN to 29", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/pantah", "sha": "5f84bb10e9c42cc86ed94e4ff13e3bcc3b97df92", "subject": "Update panther SVN to 29", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/pantah", "sha": "14e3b34089537db4fefbaba345c55900f139e18a", "subject": "Update cheetah SVN to 28", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/pantah", "sha": "82b36361bacadf9139a5f2ca39b1d83601b96e0d", "subject": "Update panther SVN to 28", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/pantah", "sha": "9dabbe6ee6205f0d5b2017e095d5ed0a292a08e4", "subject": "Update cheetah SVN to 28", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "device/google/pantah", "sha": "96f08f80638a1772e8b4835825d54944998b082f", "subject": "Update panther SVN to 28", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "device/google/pantah", "sha": "e40ba4af89f17ce0a3efa9589df0739deb46cd2e", "subject": "Update cheetah SVN to 28", "tag": "android-security-14.0.0_r2", "merged": "2023-08-06", "markers": [] }, { "project": "device/google/pantah", "sha": "5f283f4365ab0acb21b819413473a57d18d26bdf", "subject": "Update panther SVN to 28", "tag": "android-security-14.0.0_r2", "merged": "2023-08-06", "markers": [] }, { "project": "device/google/pantah", "sha": "58b2887fca294afc35873605e11608d35d50839e", "subject": "Update cheetah SVN to 27", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/pantah", "sha": "5066c38c4b644d2c470e29a7ed5697521e6d677f", "subject": "Update panther SVN to 27", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/raviole", "sha": "585c714cf0321373097e0d3f21a4840e7d42e9b4", "subject": "Update raven SVN to 66", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/raviole", "sha": "99b5280cf5f5841510353aae338d7c8fe9a967d1", "subject": "Update oriole SVN to 66", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/raviole", "sha": "7602d45ae96eafcd5ee6ec4faca378cd361be3d1", "subject": "Update raven SVN to 66", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "device/google/raviole", "sha": "0b99c85169c24ce6e37a10e024710e5b59ca0ca1", "subject": "Update oriole SVN to 66", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "device/google/raviole", "sha": "cc68ab6da03844267c658d1be1892f9492a06510", "subject": "Update raven SVN to 66", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/raviole", "sha": "c6f175b5fc8498082055f0821db4058a71e579bf", "subject": "Update oriole SVN to 66", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/raviole", "sha": "796207b60549c3d4b864ece471c5ce62a50c26aa", "subject": "Update oriole SVN to 65", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/raviole", "sha": "6f1ec7c8f915e2f7f5fcb7f6ffcd96001460975d", "subject": "Update raven SVN to 65", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/raviole", "sha": "9e3454bee06acf1b891cdbd3052f5546ad86f51f", "subject": "Update oriole SVN to 64", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/raviole", "sha": "0d1142b912cffa2683fe6f8b4d5afe8b8d0b36be", "subject": "Update raven SVN to 64", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "device/google/raviole", "sha": "7b7d998d3aa311df0a930cf605a3ce2811d7f975", "subject": "Update oriole SVN to 64", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "device/google/raviole", "sha": "82b34e12f63ed589ffc80f1147524f77c0c8f1e5", "subject": "Update raven SVN to 64", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "device/google/raviole", "sha": "c4b8a73b4da68f06e9aee455f53c301fb10554a6", "subject": "Update raven SVN to 63", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/raviole", "sha": "cbef55c5cab716c6b931cc88cf203ef64b125ceb", "subject": "Update oriole SVN to 63", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/redbull", "sha": "ddd31f4353f47bebdcfd19020ff9449ecdae4cb0", "subject": "Update redbull SVN to 73", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] }, { "project": "device/google/redbull", "sha": "dd1c2d9cb2fbe9603da24d4c92f126e66f980148", "subject": "Update redbull SVN to 71", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "platform/build", "sha": "6741c842cfb4fbdccf25e854dabdf8f35a6d1db0", "subject": "Update Security String to 2023-09-05", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285692955" ], "commits": [ { "project": "device/google/barbet", "sha": "d88d196cb7a2e952feb6ae212c6e0a0804ff2fd8", "subject": "Update barbet SVN to 44", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/bluejay", "sha": "a97531e83b486c095b734cb2f5b7c92f35900b4e", "subject": "Update bluejay SVN to 41", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/raviole", "sha": "261cabfc4620c8b961d9e4bfef8f36c5699fd34f", "subject": "Update raviole SVN to 62", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/redbull", "sha": "9536b578af680a23d95e7a65947bbccd6d3bf369", "subject": "Update redbull SVN to 70", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "device/google/sunfish", "sha": "da976752a6252aa57717244cdfd7f18b9f6e3c42", "subject": "Update sunfish SVN to 64", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "293213801" ], "commits": [ { "project": "device/google/bluejay", "sha": "e6bd74cb399e40bd6b3330493959a7723ff072b1", "subject": "gps: Disable Vzw SUPL OTDOA", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/felix", "sha": "4214a4b7ad63aa36db3d8f6a99398417df85728b", "subject": "gps: Disable Vzw SUPL OTDOA", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/lynx", "sha": "17bb9133e004b99c57ef3bcfc44f821d8cc90cf1", "subject": "gps: Disable Vzw SUPL OTDOA", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/pantah", "sha": "c58211f2e79a40b7246b0d026b3939c1927d7c86", "subject": "gps: Disable Vzw SUPL OTDOA", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "device/google/raviole", "sha": "c9b70e35664a4e5fb1d9c98cd4f92edd7cf792a0", "subject": "gps: Disable Vzw SUPL OTDOA", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285290323", "290721507" ], "commits": [ { "project": "device/google/felix", "sha": "227e1a2bf7bcc04cee7fbf2fdfbe6f78bed532ca", "subject": "Fix layout issue of pattern set up page in F10", "tag": "android-security-14.0.0_r2", "merged": "2023-08-01", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289752109" ], "commits": [ { "project": "device/google/felix", "sha": "8b62cc5ed80b944dcc5109393156ed1683813851", "subject": "thermal: modify emergency and shutdown threshold for VIRTUAL-SKIN", "tag": "android-security-14.0.0_r2", "merged": "2023-07-26", "markers": [] }, { "project": "device/google/felix", "sha": "6c2cd58841b3e8e93041573ec17f8e748e90355c", "subject": "thermal: Update VSKIN equation V06.2", "tag": "android-security-14.0.0_r2", "merged": "2023-07-19", "markers": [] }, { "project": "device/google/felix", "sha": "fbe12053106b7390175371c889123bac5e3aa718", "subject": "thermal: modify emergency and shutdown threshold", "tag": "android-security-14.0.0_r2", "merged": "2023-07-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289884022" ], "commits": [ { "project": "device/google/felix", "sha": "e98accf2e3bc8202b278f0818c47d39d09df4efe", "subject": "uwb calibration: fix distance range bias", "tag": "android-security-14.0.0_r2", "merged": "2023-07-25", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284431215" ], "commits": [ { "project": "device/google/felix", "sha": "cda49c53f57ca2fa1cf1273cd36bdd8919d87fca", "subject": "hall_sensor: Disable hall sensor input when bootmode is unknown", "tag": "android-security-14.0.0_r2", "merged": "2023-07-09", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "295291089" ], "commits": [ { "project": "device/google/gs-common", "sha": "e84c2678707843e9a1118c4953929d1205c597ab", "subject": "update gps sdk 147.20.23.576859", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "294102841", "294294528" ], "commits": [ { "project": "device/google/gs-common", "sha": "441c2a697c4ec934d362c9ded1c388c2700899cf", "subject": "update gps sdk 147.20.23.576052", "tag": "android-security-14.0.0_r2", "merged": "2023-08-04", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290249239" ], "commits": [ { "project": "device/google/gs101", "sha": "c6b5b5990a4edb6a6dc55fea851acb114c57bb26", "subject": "EGL: Reduce multifile blobcache limit to 32MB", "tag": "android-security-14.0.0_r2", "merged": "2023-07-15", "markers": [] }, { "project": "device/google/gs201", "sha": "75e52327cd8b24fc6bcec2f4876ae8fc9703737f", "subject": "EGL: Reduce multifile blobcache limit to 32MB", "tag": "android-security-14.0.0_r2", "merged": "2023-07-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289317242" ], "commits": [ { "project": "device/google/gs101", "sha": "09e693efd9f6fc65238924f7e82eca4174d88b62", "subject": "Use version 1 of the DBA service, since version 1 is the only frozen version. bug:289317242 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e5e62a21a0c0b02577d6ed0e8f08d7566fc6a384) Merged-In: I770b006b364eb371f4df95f48e2fe5be0c9a9bff Change-Id: I770b006b364eb371f4df95f48e2fe5be0c9a9bff", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] }, { "project": "device/google/gs201", "sha": "cb1827e7b624e22f73ca56c8839bdb3d14cec45b", "subject": "Use version 1 of the DBA service, since version 1 is the only frozen version. bug:289317242 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:66a548d416e7461de1cd600be336f5d693ba4b9c) Merged-In: Ieec5b8b48c3567c940717df55a2e4582ef47d16c Change-Id: Ieec5b8b48c3567c940717df55a2e4582ef47d16c", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288859756" ], "commits": [ { "project": "device/google/gs101", "sha": "c4f7795fa2f64110f0a13302fd38f390efdbcda4", "subject": "Update media_codecs_performance_c2.xml for meet device performance", "tag": "android-security-14.0.0_r2", "merged": "2023-07-07", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "279092299" ], "commits": [ { "project": "device/google/gs101", "sha": "bc400a27008d7e41212c3c1b549ae6f036fee1e1", "subject": "[RESTRICT AUTOMERGE] Increase the com.google.edgetpu.dba service version to 2 in the framework matrix xml", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [ "restrict_automerge" ] }, { "project": "device/google/gs201", "sha": "01ab29cf9699b11b7ea5506e08e662d490b13d5d", "subject": "[RESTRICT AUTOMERGE] Increase the com.google.edgetpu.dba service version to 2 in the framework matrix xml.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287169829" ], "commits": [ { "project": "device/google/gs101-sepolicy", "sha": "12abc8ef4aa73a849d72f13ab18bf901b2543703", "subject": "Update SELinux error", "tag": "android-security-14.0.0_r2", "merged": "2023-06-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287082706" ], "commits": [ { "project": "device/google/pantah", "sha": "89b7519ad4390b21a0a9ef98577da6bd61c691a7", "subject": "uwb: update calibration for range bias", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] }, { "project": "device/google/raviole", "sha": "ed5126c902cd181ec372cfb795cf4e944407a544", "subject": "uwb: update calibration for range bias", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291147977" ], "commits": [ { "project": "device/google/tangorpro", "sha": "3fe5b37b93a586d014d586ff71ed27cfc3110a30", "subject": "Fix tangorpro_car build file path", "tag": "android-security-14.0.0_r2", "merged": "2023-07-20", "markers": [] }, { "project": "device/google_car", "sha": "fe31c6e7b65d0c6e0b0f8bc68710d3703e043cad", "subject": "Add Tangorpro_car build support", "tag": "android-security-14.0.0_r2", "merged": "2023-07-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287082706", "289062178" ], "commits": [ { "project": "device/google/tangorpro", "sha": "4198b63132888ea7c2b01eda3d9dfed00bbcc17e", "subject": "uwb: update uwb calibration for T6P", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "device/google/tangorpro", "sha": "24014de57137825b35a695288c2b17b659dde5cf", "subject": "uwb: update uwb calibration for T6P", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "229618060" ], "commits": [ { "project": "platform/art", "sha": "f86e97a606930ca4c8b043b752f4a7f853e64359", "subject": "Update default values for metrics flags to enable reporting from public am: 5bf0f68407 am: aa2c59af69 am: 65c6dd0a09 am: 16e7cfbf17 am: d416febde2 am: b0d3d8fd04", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283202477", "288991737" ], "commits": [ { "project": "platform/bionic", "sha": "2e4906d09e4316fa6f54d445cfa9bb1d1d98ac6c", "subject": "Revert \"Use proprety_socket_for_system if permissions allow\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/bionic", "sha": "42b1941691c757d70833bd90e7dbac69672a00a9", "subject": "Revert \"Fix deadlock caused by two-threaded property controls\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/bionic", "sha": "1133a8d39fa6ec881d5346894dc2c7e0ff3cd198", "subject": "Revert \"Use proprety_socket_for_system if permissions allow\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/bionic", "sha": "6b424c3bf62d84c806cb645ce31155a2d2d9fbbc", "subject": "Revert \"Fix deadlock caused by two-threaded property controls\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/system/core", "sha": "8543f7dcd4fa94c7aeba938ad78679915ea8b1cd", "subject": "Revert \"Listen on property_service_for_system socket\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/system/core", "sha": "3adb2a63bed9e97a5a179316b4f14a3196df81e3", "subject": "Revert \"Fix deadlock caused by two-threaded property controls\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/system/core", "sha": "de5f915991bb445ddadd4a3889874ee97dc7913d", "subject": "Revert \"Listen on property_service_for_system socket\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/system/core", "sha": "ad6ca1451d034cb381d99f9b170a1024bb1d5014", "subject": "Revert \"Fix deadlock caused by two-threaded property controls\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287896098" ], "commits": [ { "project": "platform/build", "sha": "0e7644ff0674fd5fb86502b6a8f9c05332634041", "subject": "Handle symlinks when extracting zipfiles", "tag": "android-security-14.0.0_r2", "merged": "2023-07-21", "markers": [] }, { "project": "platform/build", "sha": "48b23028a4aa80a97c948e041e12253d8afcdb54", "subject": "Handle symlinks when extracting zipfiles", "tag": "android-security-14.0.0_r2", "merged": "2023-07-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283033491" ], "commits": [ { "project": "platform/build", "sha": "753c1468e2b5e051cf03870d0279dae588513124", "subject": "Handle zip64 extra fields better", "tag": "android-security-14.0.0_r2", "merged": "2023-07-21", "markers": [] }, { "project": "platform/build", "sha": "9021cb5ae1440d20686d1b8929fcb0959f56d7fc", "subject": "Fix python3.11's support for zip64", "tag": "android-security-14.0.0_r2", "merged": "2023-07-21", "markers": [] }, { "project": "platform/build", "sha": "512a1f5f2d13f4b28db3f2f7d89151f31345db95", "subject": "Use python based unzip function for portability", "tag": "android-security-14.0.0_r2", "merged": "2023-07-21", "markers": [] }, { "project": "platform/build", "sha": "f604d01ba4e169415cf62899fca0d6e395c18a38", "subject": "Handle zip64 extra fields better", "tag": "android-security-14.0.0_r2", "merged": "2023-07-19", "markers": [] }, { "project": "platform/build", "sha": "1836ac3ff7e806aecfa21003b5e4b037622989a8", "subject": "Fix python3.11's support for zip64", "tag": "android-security-14.0.0_r2", "merged": "2023-07-19", "markers": [] }, { "project": "platform/build", "sha": "e95f57f9bd279c75096c5936b80e52be243fd61b", "subject": "Use python based unzip function for portability", "tag": "android-security-14.0.0_r2", "merged": "2023-07-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "266726655" ], "commits": [ { "project": "platform/build", "sha": "8f93cf447df38ce6107848ba6c56cc2223cfa4cb", "subject": "Support SBOM generation of m build unbundled APEXs.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "280852724" ], "commits": [ { "project": "platform/build", "sha": "42cfcfe288f8daf51c13131dbc8b700076df30fe", "subject": "Include static libraries information in Android SBOM.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] }, { "project": "platform/build/bazel", "sha": "b02aa8f6f4821e5f3514ce4fd2369944cab117d8", "subject": "Add columns for static_libraries, whole_static_libraries and is_static_lib in SBOM metadata CSV file generated in Bazel for unbundled APEXs.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290361803" ], "commits": [ { "project": "platform/build", "sha": "a035e7cb558cd44681c2833773a62ec8c3f704dc", "subject": "Dist kernel_version.txt", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286892268" ], "commits": [ { "project": "platform/build", "sha": "a64a599f7b7cbf541de3a310bbe66aa53a265b1d", "subject": "DO NOT MERGE: Enable mainline prebuilts for device targets", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "271768933", "286415307" ], "commits": [ { "project": "platform/build", "sha": "8bb740db1ae9bf65d1eadaeb057a54ebcd8d2c3b", "subject": "Add aosp_arm64_fullmte target", "tag": "android-security-14.0.0_r2", "merged": "2023-06-13", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286415307" ], "commits": [ { "project": "platform/build", "sha": "0f79319bb8318077a86cc7e090364b1a70cbeba5", "subject": "Fix bug when memtag_heap in diag but not sanitizers", "tag": "android-security-14.0.0_r2", "merged": "2023-06-13", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "292173416" ], "commits": [ { "project": "platform/cts", "sha": "156e957c49d47f298c4d166cdcd4da02cecd5722", "subject": "cts: Add uwb tests to known failures list", "tag": "android-security-14.0.0_r2", "merged": "2023-07-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284406623" ], "commits": [ { "project": "platform/cts", "sha": "216c9e517d17009a2460272824080d4e804fa31b", "subject": "cts-on-gsi: Exclude uwb tests on gsi", "tag": "android-security-14.0.0_r2", "merged": "2023-07-26", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288944462" ], "commits": [ { "project": "platform/cts", "sha": "9c577373a7b1b7f26f8687efd9134ff46aa19608", "subject": "verifier: disable report logging in Data Paths", "tag": "android-security-14.0.0_r2", "merged": "2023-07-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289982883" ], "commits": [ { "project": "platform/cts", "sha": "915a5a84cb292abed4b78eda5cfffa7978dc7f56", "subject": "DO NOT MERGE - Remove DataPaths test from CTS-Verifier Test Module List", "tag": "android-security-14.0.0_r2", "merged": "2023-07-15", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288828383" ], "commits": [ { "project": "platform/cts", "sha": "31a0d3010e951b38f999a93078b0e8e1e799ce45", "subject": "Fix CTS tests to work when vibration is not supported by device", "tag": "android-security-14.0.0_r2", "merged": "2023-07-09", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289020974" ], "commits": [ { "project": "platform/cts", "sha": "e5ed65f5c6fc64faf153eee937ee4b5534e2e965", "subject": "Restore setTestNameSuffix method to old version", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "255265824", "289019434" ], "commits": [ { "project": "platform/cts", "sha": "85165a9bfd984c79b4baa39e5f351f3999a24f03", "subject": "Save and restore display mode for CtsVerifier", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288921015" ], "commits": [ { "project": "platform/cts", "sha": "cd9b245c052c80f37d90a799d99dd126e67d4192", "subject": "Fix time handling problem in DataPaths test. (cp'd from ag/23817828)", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "281477191" ], "commits": [ { "project": "platform/cts", "sha": "e198f36e5dbe2bdd9f6403093477adef1ef7fa12", "subject": "Allow CTS-V batching sensor test to pass in \"either_mode\"", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288800105" ], "commits": [ { "project": "platform/cts", "sha": "da361ba2b5c02cd205e449073f2bcff20ca81829", "subject": "Add null check for testListItem", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286026837" ], "commits": [ { "project": "platform/cts", "sha": "12fbc6f8104b7050dfda124a537efa77bde99f10", "subject": "Call older version UserManager#getUsers prior to U", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288271341" ], "commits": [ { "project": "platform/cts", "sha": "c4240f6072ded7f607ef13dd305094c9377ac97f", "subject": "test_display_p3: Use the colour library instead of ImageCms", "tag": "android-security-14.0.0_r2", "merged": "2023-06-27", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285449475" ], "commits": [ { "project": "platform/cts", "sha": "cf558a7ace2a7fa95e8feccbd26dbfb61a773c90", "subject": "Exclude BluetoothMultiDevicesTest in CtsBluetoothMultiDevicesTestCases", "tag": "android-security-14.0.0_r2", "merged": "2023-06-27", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286302578" ], "commits": [ { "project": "platform/cts", "sha": "cfa3d7dd5a6f1f661818c6541ea239e9d3f3773c", "subject": "ITS: clear unavailable cam event queue @ cam close", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] }, { "project": "platform/cts", "sha": "ac191718f2c0adaf04f1fa75df12f67cf2b92e4a", "subject": "ITS: clear unavailable cam event queue @ cam close", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287586918" ], "commits": [ { "project": "platform/cts", "sha": "6b7d76d12771c902607ea034cab2ad721de9cb39", "subject": "Add SharedLibraryInfoTestApp as a data dep to CtsClasspathDeviceInfoTestCases.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286293966" ], "commits": [ { "project": "platform/cts", "sha": "8148406e76fe41c7f4d2cdee9b0aeb3036b79631", "subject": "Fix remaining reference to \"Touch sounds\"", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283835959" ], "commits": [ { "project": "platform/cts", "sha": "f370217809b4ca704659a449145d770cc9511af5", "subject": "Test SpeakerSafe MMAP Datapath", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284917528" ], "commits": [ { "project": "platform/cts", "sha": "1f90b369b1e2f2f9fd1add1a5a0c78cbcb8f7de4", "subject": "Exclude the odsign_e2e_tests module on cts-on-gsi-exclude.xml", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286981561" ], "commits": [ { "project": "platform/cts", "sha": "3d48fcdc2fe765d71819588c0b2f7ef6f4621e6a", "subject": "Change the min sdk of helper apps to 29", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "239039214" ], "commits": [ { "project": "platform/cts", "sha": "c25ad4e3cd743eef765bead61a37c55de450a509", "subject": "CtsVerifier: only write one loopback latency result", "tag": "android-security-14.0.0_r2", "merged": "2023-06-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286943865" ], "commits": [ { "project": "platform/cts", "sha": "3f7492d6ed02aced5e26e80d2b7b2b488802d47c", "subject": "Fix missing \"ave\" ReportLog key.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "244389128", "260029549" ], "commits": [ { "project": "platform/cts", "sha": "e6ec5d2d94037e80a561ca7a5ff47370142cf226", "subject": "Prompt for ReportLog permissions only for tests that use ReportLog", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289293448" ], "commits": [ { "project": "platform/development", "sha": "edab64ee477a76961d362c58ec72c5ba6ceaacf1", "subject": "Update API 34 release config and emulator files for UDC Beta4", "tag": "android-security-14.0.0_r2", "merged": "2023-08-03", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283246642" ], "commits": [ { "project": "platform/external/perfetto", "sha": "df958f6b3a78e535ab0f6e5bc829c4fe0f063541", "subject": "protozero: implement string filtering as part of message filtering", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] }, { "project": "platform/external/perfetto", "sha": "589fc100e38f1ae9f07b7a19d177e47b931b9bd8", "subject": "protozero: add filtering bytecode v2 with support for string filtering", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] }, { "project": "platform/external/perfetto", "sha": "d0d520995cd4491cf5fe0a59d5045b2c06cedc8d", "subject": "protozero: add nested_msg_field flag for in filtering bytecode parsing", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] }, { "project": "platform/external/perfetto", "sha": "8fcab5b2123a366565bea156702260c260ce7a20", "subject": "protozero: reject end of message handling edge case in filtering", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "186777432", "289111414" ], "commits": [ { "project": "platform/external/skia", "sha": "de4dc2b6192f0b632ea7f37af0ab38fad7f82b90", "subject": "RESTRICT AUTOMERGE Roll Skia from d64928640a1b to ae193d0cc7e3 (1 revision)", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "294920725" ], "commits": [ { "project": "platform/frameworks/av", "sha": "8393148c488ab0ddd195bcbb84e0c819ec117fc4", "subject": "Hide accurate onFrameRendered calls behind render metrics feature flag", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290155485" ], "commits": [ { "project": "platform/frameworks/av", "sha": "f0c9e5f44926c38eefeb17c008c51c663e7a0030", "subject": "Camera: Fix FD leak", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287182335" ], "commits": [ { "project": "platform/frameworks/av", "sha": "35d6422e65b7ba8f998f16ea52d7da0995aacc4f", "subject": "Allow DAP render-only mix to be matched to mmap-ed stream.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287905056" ], "commits": [ { "project": "platform/frameworks/av", "sha": "983a764e2f7a31f9796b3f4d95e9c0751978a5a0", "subject": "Camera: Ensure 'isSlowJpegModeForced' is always initialized", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "271143048" ], "commits": [ { "project": "platform/frameworks/av", "sha": "88c14c451ca0a477b343522b2bf3629a4bc9322f", "subject": "Camera: Add links to mandatory stream combination tables", "tag": "android-security-14.0.0_r2", "merged": "2023-06-14", "markers": [] }, { "project": "platform/frameworks/base", "sha": "c55b4a1ef071401cffd28ca51439dba0c2e86da0", "subject": "Camera: Create links to mandatory stream combinations", "tag": "android-security-14.0.0_r2", "merged": "2023-06-14", "markers": [] }, { "project": "platform/hardware/interfaces", "sha": "3e4fbc9a22969c4e2dbe7e689d1786b5c31ed5ad", "subject": "Camera: Add links to mandatory stream combination tables", "tag": "android-security-14.0.0_r2", "merged": "2023-06-14", "markers": [] }, { "project": "platform/system/media", "sha": "5f917e282d9521fcdc4f549286d3ae63a638b6dd", "subject": "Camera: Add links to mandatory stream combinations tables", "tag": "android-security-14.0.0_r2", "merged": "2023-06-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284273379" ], "commits": [ { "project": "platform/frameworks/av", "sha": "9492b0748d530c4f1d858acd5dc702791d75afa5", "subject": "cameraserver: Fix DYNAMIC_DEPTH / HEIC keys selected for UHR stream configurations.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-13", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "227201030" ], "commits": [ { "project": "platform/frameworks/base", "sha": "bd0881cd77688060a16709e24c3b6a7c75dcbb03", "subject": "[SettingsProvider] verify ringtone URI before setting", "tag": "android-security-14.0.0_r2", "merged": "2023-09-07", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "297230599" ], "commits": [ { "project": "platform/frameworks/base", "sha": "2f359c1ddfd33449f5219f70622f21049c15d895", "subject": "Fix possible leaks in CanvasContext HintSessionWrapper", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "296960974" ], "commits": [ { "project": "platform/frameworks/base", "sha": "67883d3eb63af08f622636ad26ce416cd377e58a", "subject": "Revert \"Import translations. DO NOT MERGE ANYWHERE\"", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "234093736" ], "commits": [ { "project": "platform/frameworks/base", "sha": "93b49babc47c1b04b24ae7c34fe9d808fb7bba5a", "subject": "Only create InsetsSourceConsumer for InsetsSourceControl", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "280003654" ], "commits": [ { "project": "platform/frameworks/base", "sha": "0b7bdf9b18dc799a67b3c9e9fdee384b39d44bb1", "subject": "Add a flag byForegroundService to enqueueNotification() call.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "292063872" ], "commits": [ { "project": "platform/frameworks/base", "sha": "297db07fd76c7adf5691d7d07506d8138f139778", "subject": "Fix large clock flickers when animated in Felix", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "281965452" ], "commits": [ { "project": "platform/frameworks/base", "sha": "de1f76fece78ee7bd7c436faa170f48371dc7520", "subject": "Change behind-scrim's tint in BOUNCER state to match GM3 surface color.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "platform/frameworks/base", "sha": "dc9b1d3a1c531c4f1f44b1570540cdf5ba4adb5d", "subject": "Change behind-scrim's tint in BOUNCER state to match GM3 surface color.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/frameworks/base", "sha": "36a26f30291fd2ec61759e116b60f5df197de81e", "subject": "Change behind-scrim's tint in BOUNCER state to match GM3 surface color.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/frameworks/base", "sha": "0b184b669c4ddd602cbe3da97a37ecf112392c73", "subject": "Change behind-scrim's tint in BOUNCER state to match GM3 surface color.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/frameworks/base", "sha": "0f5f4e07de21a0b789218ace23dacbca2eeedf30", "subject": "Change behind-scrim's tint in BOUNCER state to match GM3 surface color.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/frameworks/base", "sha": "4e6a3fe6971b685987742230601dc1f9dcae11a4", "subject": "Change behind-scrim's tint in BOUNCER state to match GM3 surface color.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "platform/frameworks/base", "sha": "54e819540383b5b0819c0ba4826e0cd3cdfe4484", "subject": "Change behind-scrim's tint in BOUNCER state to match GM3 surface color.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "platform/frameworks/base", "sha": "faa7ee945da69c77a75f37bd4ae3b61e1ed2cc98", "subject": "Change behind-scrim's tint in BOUNCER state to match GM3 surface color.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/frameworks/base", "sha": "daa23804e9b526d485792f106bcd51435defdde4", "subject": "Change behind-scrim's tint in BOUNCER state to match GM3 surface color.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288761850" ], "commits": [ { "project": "platform/frameworks/base", "sha": "457bd0460ed11bcd7cf2d4f6d5dd00f69a2aaf90", "subject": "Fix biometric context update problem.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "platform/frameworks/base", "sha": "5b9076c604c0f0f44fce1b5170dc2dbbd12d231d", "subject": "Fix biometric context update problem.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/frameworks/base", "sha": "b47192e3bb974c33e930325a0d5cdedcd5891eeb", "subject": "Fix biometric context update problem.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/frameworks/base", "sha": "8b7bdf334b0a37c0b034adcf01b5b85978d5523b", "subject": "Fix biometric context update problem.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/frameworks/base", "sha": "7c624e076cc9feda401a45f18ffc5d2221f60ebe", "subject": "Fix biometric context update problem.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/frameworks/base", "sha": "48f7ae91009ebae13e3a22b9f8eb63da5694a55d", "subject": "Fix biometric context update problem.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "platform/frameworks/base", "sha": "f50850a5ed138bb3628260f6270437f0e621943d", "subject": "Fix biometric context update problem.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "platform/frameworks/base", "sha": "9e6c34e76e0e707ec5f985f8d00036385612aa2e", "subject": "Fix biometric context update problem.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/frameworks/base", "sha": "e05561bb5defe12e277904ce35d429139086ca26", "subject": "Fix biometric context update problem.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283958440" ], "commits": [ { "project": "platform/frameworks/base", "sha": "1e5432313cb088f03e528532518f0dd5e8225347", "subject": "[Status Bar] Set status bar window insets to status bar height always.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "platform/frameworks/base", "sha": "31e654d1278627bff86041bbce0dbe2c3b1ab872", "subject": "[Status Bar] Set status bar window insets to status bar height always.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/frameworks/base", "sha": "cf67023fa75cfd56ff2717a0e0b39f8f2cde68d0", "subject": "[Status Bar] Set status bar window insets to status bar height always.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/frameworks/base", "sha": "5867b7576a92113cb196f9b04bbd471fb1e57ed0", "subject": "[Status Bar] Set status bar window insets to status bar height always.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/frameworks/base", "sha": "073fc5e910e0b9630a2b79d5ddc9dfafeaca5229", "subject": "[Status Bar] Set status bar window insets to status bar height always.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/frameworks/base", "sha": "46ac6f8b0d74f20b2ffe65386a1788ba02dd5efd", "subject": "[Status Bar] Set status bar window insets to status bar height always.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "platform/frameworks/base", "sha": "4e6f49df54e7cf40e3bc8df735d3e15d4644002a", "subject": "[Status Bar] Set status bar window insets to status bar height always.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "platform/frameworks/base", "sha": "0bafb4142fad38b0c141db7b31b67bb4bc6331e9", "subject": "[Status Bar] Set status bar window insets to status bar height always.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/frameworks/base", "sha": "96beef41e60de584ae2a7b56f131b1bdbc478fec", "subject": "[Status Bar] Set status bar window insets to status bar height always.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/frameworks/base", "sha": "87e54f26d37ff7609dd92881fe753cc5bd9f7279", "subject": "[Status Bar] Set status bar window insets to the status bar height.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291826358" ], "commits": [ { "project": "platform/frameworks/base", "sha": "b524d44955dcb72553df4dd7abfc34a9afa41737", "subject": "[MediaProjection] Address deadlock between multiple services", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "266197298", "292472402", "293131586" ], "commits": [ { "project": "platform/frameworks/base", "sha": "d584565f66fb8bd7ef805c2b46e02c4fe9ab61cd", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "platform/frameworks/base", "sha": "93fffde25bd02941e2f8afc4a32591aefc387218", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/frameworks/base", "sha": "7ac6188dcc9c3db53e68169ffc8240e6d3374754", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/frameworks/base", "sha": "3fb6e2a32faa10280c3a9d9305cbcca73e1cd5db", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/frameworks/base", "sha": "8a9fdc06a74979292b7ca53391595125bfcb6c94", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/frameworks/base", "sha": "859126d3d3707f7ff9f856f8f0476b840c8537a8", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "platform/frameworks/base", "sha": "0711ce3cb22c5c71c6bdf6be951b81d9a2e551c2", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "platform/frameworks/base", "sha": "c1fda536bddf0a6697aef53deba12c44aad60336", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/frameworks/base", "sha": "c8db313861964001919fbeed05346abcc382f842", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/frameworks/base", "sha": "7ba85a46287979d089f4568bb002323cb611a6cb", "subject": "Enable insets cache for display switch", "tag": "android-security-14.0.0_r2", "merged": "2023-08-04", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "231476072" ], "commits": [ { "project": "platform/frameworks/base", "sha": "97f621d81fc51de240ba73bc008d997e0eea7939", "subject": "Update parcling logic for Uris.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286996125" ], "commits": [ { "project": "platform/frameworks/base", "sha": "5e7f8d8aca7b040f5ab57af3af4a72095d425e0c", "subject": "Import translations. DO NOT MERGE ANYWHERE", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [ "restrict_automerge" ] }, { "project": "platform/frameworks/base", "sha": "7aa5b1415941f8c4172d02072f59349d30450232", "subject": "Import translations. DO NOT MERGE ANYWHERE", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [ "restrict_automerge" ] }, { "project": "platform/frameworks/base", "sha": "192e1926b13df12563dfb0bb38f98d31b7f41d67", "subject": "Import translations. DO NOT MERGE ANYWHERE", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [ "restrict_automerge" ] }, { "project": "platform/frameworks/base", "sha": "204ea4a673cc47f154cbff66d664618f1942b6b9", "subject": "Import translations. DO NOT MERGE ANYWHERE", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [ "restrict_automerge" ] }, { "project": "platform/frameworks/base", "sha": "917729f52b84d8ff1140ece2dd696914426adcd3", "subject": "Import translations. DO NOT MERGE ANYWHERE", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "205837340" ], "commits": [ { "project": "platform/frameworks/base", "sha": "afdaf7cae37ae1e1abd5cece2e175e914ed495f0", "subject": "RingtoneManager: verify default ringtone is audio", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284687313" ], "commits": [ { "project": "platform/frameworks/base", "sha": "edeccfab70bba799018a839c364e6f995efb2ef1", "subject": "DO NOT SUBMIT (Testing Code)", "tag": "android-security-14.0.0_r2", "merged": "2023-08-18", "markers": [] }, { "project": "platform/frameworks/base", "sha": "1857f2f9ff111fec7fe5037376b761f047aca050", "subject": "DO NOT SUBMIT (Testing Code)", "tag": "android-security-14.0.0_r2", "merged": "2023-08-17", "markers": [] }, { "project": "platform/frameworks/base", "sha": "f1191ceb489cdae1855ff92d777bcaa4301c60e0", "subject": "DO NOT SUBMIT (Testing Code) Simulate InCallActivity with DisplayState = OFF", "tag": "android-security-14.0.0_r2", "merged": "2023-08-17", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "293159518", "293464892" ], "commits": [ { "project": "platform/frameworks/base", "sha": "01b1b256babba19a4e9050287b9af246393ef364", "subject": "Check for non-interactive dreams when wake and unlocking.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "platform/frameworks/base", "sha": "e11a57ea172240214571620f3be1491629c3eeca", "subject": "Check for non-interactive dreams when wake and unlocking.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/frameworks/base", "sha": "cc5f08ca2ba2b622b215d19ad4efa64feb1343b5", "subject": "Check for non-interactive dreams when wake and unlocking.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/frameworks/base", "sha": "9ff56882d0c6436346b12799d06c9f07821a2397", "subject": "Check for non-interactive dreams when wake and unlocking.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-04", "markers": [] }, { "project": "platform/frameworks/base", "sha": "db4ae3f904d1bbc2f94b558d7cad48766126627d", "subject": "Check for non-interactive dreams when wake and unlocking.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-03", "markers": [] }, { "project": "platform/frameworks/base", "sha": "33a526ce7f5e5b02b964fca8596133f6a086fb35", "subject": "Check for non-interactive dreams when wake and unlocking.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-01", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283073563" ], "commits": [ { "project": "platform/frameworks/base", "sha": "ea5c7ffb98957a4df7587210732e9e0715c87c98", "subject": "Allow remote input to send intent from background", "tag": "android-security-14.0.0_r2", "merged": "2023-08-04", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284669723", "288201661", "289334181" ], "commits": [ { "project": "platform/frameworks/base", "sha": "2f4880c58ad6725ddf28ee8c617a566e8692208c", "subject": "Consolidate DISABLE_RECENT condition in adjustStatusBarLocked()", "tag": "android-security-14.0.0_r2", "merged": "2023-07-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "293210067" ], "commits": [ { "project": "platform/frameworks/base", "sha": "5ea7e53c3a787e25af86b0f31933ddd68ae3514e", "subject": "Allow system installer to deny update ownership", "tag": "android-security-14.0.0_r2", "merged": "2023-07-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288467787" ], "commits": [ { "project": "platform/frameworks/base", "sha": "19cfb3ff1655e33431bd57a7bc735304e80c660e", "subject": "Remove top margin from dream status bar items", "tag": "android-security-14.0.0_r2", "merged": "2023-07-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288205940" ], "commits": [ { "project": "platform/frameworks/base", "sha": "4ee9feec0fdba84deca18990f15247ecd6560267", "subject": "Add comments stating the configs for visible background users are not ready for production", "tag": "android-security-14.0.0_r2", "merged": "2023-07-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289464589" ], "commits": [ { "project": "platform/frameworks/base", "sha": "b3691fab2356133dfc7e11c213732ffef9a85315", "subject": "Disable screen wake locks for cached apps", "tag": "android-security-14.0.0_r2", "merged": "2023-07-26", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "282865576" ], "commits": [ { "project": "platform/frameworks/base", "sha": "a159dafdc0a5f0635852fdff93b4670ab95476d7", "subject": "Don't attach pipeline to group expansion mgr.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-25", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289276920" ], "commits": [ { "project": "platform/frameworks/base", "sha": "5625faf30fc63ee1c47992299f64eb331fa8910c", "subject": "Fix no KeyguardStatusView on lock screen", "tag": "android-security-14.0.0_r2", "merged": "2023-07-25", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290812970" ], "commits": [ { "project": "platform/frameworks/base", "sha": "e613c5324b311ce2666acc89e9fd2000da99c63f", "subject": "Use a single thread executor for calculateHasIncompatibleAccounts", "tag": "android-security-14.0.0_r2", "merged": "2023-07-25", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "282102652" ], "commits": [ { "project": "platform/frameworks/base", "sha": "853127181ecaaef3b9d2df92f1bd40451493b1c5", "subject": "Fix how taskview is used by controlsUi", "tag": "android-security-14.0.0_r2", "merged": "2023-07-25", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289861878" ], "commits": [ { "project": "platform/frameworks/base", "sha": "58d31fbf718b50d9b3f4a5cc83b90de4808d5259", "subject": "Handle waking from unlock in KeyguardViewMediator.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-23", "markers": [] }, { "project": "platform/frameworks/base", "sha": "3ec325108ded855afbb4f750e21b3c33dbb742fe", "subject": "Order awakening from dream after unlocking.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/frameworks/base", "sha": "5a363a19b1ab50c1fc7dce20cf6102f09b22300e", "subject": "Order awakening from dream after unlocking.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286777009" ], "commits": [ { "project": "platform/frameworks/base", "sha": "26fa1a2bbefaaed1c585411efe98bdd7ec2a3300", "subject": "Send user activity when dream quits unexpectedly", "tag": "android-security-14.0.0_r2", "merged": "2023-07-23", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286459841" ], "commits": [ { "project": "platform/frameworks/base", "sha": "c9c16cd79e28e2c738dfb12f3328687fac40bbea", "subject": "[pm] do not stop system apps with disabled a launcher activity", "tag": "android-security-14.0.0_r2", "merged": "2023-07-23", "markers": [] }, { "project": "platform/frameworks/base", "sha": "ed9826e072d062a47fd61a4006be406040bf62aa", "subject": "[pm] fix SCAN_AS_STOPPED_SYSTEM_APP for restoreDisabledSystemPackage", "tag": "android-security-14.0.0_r2", "merged": "2023-07-23", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288516227" ], "commits": [ { "project": "platform/frameworks/base", "sha": "849366b276a33397670c5e0cd6986ae88dfbc58a", "subject": "Allow additional reason/surface combinations for cancel", "tag": "android-security-14.0.0_r2", "merged": "2023-07-23", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291711966" ], "commits": [ { "project": "platform/frameworks/base", "sha": "698495003aa6eb878e0d62d2fe28d917c51d5267", "subject": "Replace \":strings\" with \"strings\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-23", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290106681" ], "commits": [ { "project": "platform/frameworks/base", "sha": "e636d7625e30917a8db637e199fb044cecc1c83e", "subject": "Wrap the lottie views and trace whenever it invalidates", "tag": "android-security-14.0.0_r2", "merged": "2023-07-23", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "280516527", "290203002" ], "commits": [ { "project": "platform/frameworks/base", "sha": "3548fd2d5d7be05419412fc0c63c245af1236173", "subject": "Clean up postWindowRemoveStartingWindowCleanUp", "tag": "android-security-14.0.0_r2", "merged": "2023-07-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291599121" ], "commits": [ { "project": "platform/frameworks/base", "sha": "06c5a69a25d814017822fd96751a2e8c26ff33d3", "subject": "Update to cold launch if the process is restarted during launching", "tag": "android-security-14.0.0_r2", "merged": "2023-07-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "263932616", "289079608" ], "commits": [ { "project": "platform/frameworks/base", "sha": "13e05f3cc7fbf6baee2222a2a07db0b8bc42e175", "subject": "RESTRICT AUTOMERGE Center align the lock screen wallpaper", "tag": "android-security-14.0.0_r2", "merged": "2023-07-20", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "282129721" ], "commits": [ { "project": "platform/frameworks/base", "sha": "1c7560ce3b1d4573f755ce345057e844201c76a6", "subject": "Add a failsafe to update surface position after activity-level transit", "tag": "android-security-14.0.0_r2", "merged": "2023-07-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291300765" ], "commits": [ { "project": "platform/frameworks/base", "sha": "417902ac7109784555f098c32618dd535ae0ad8e", "subject": "Disable Clock View Layer and ignore assigned alpha", "tag": "android-security-14.0.0_r2", "merged": "2023-07-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291053623" ], "commits": [ { "project": "platform/frameworks/base", "sha": "44b9c7d92d02448ecdb903b60fcda1458d3a8d6f", "subject": "Avoid sending messages of destroyed Engine", "tag": "android-security-14.0.0_r2", "merged": "2023-07-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290104871" ], "commits": [ { "project": "platform/frameworks/base", "sha": "6a2ab0c0888d9c51f89ceac700d28c50a90a2fd9", "subject": "Enable VK_EXT_global_priority", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/frameworks/base", "sha": "cca3bfaa040bd1842c947d57b61491557713b9a5", "subject": "Enable VK_EXT_global_priority", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291284150" ], "commits": [ { "project": "platform/frameworks/base", "sha": "ccf9c39a4e4a70ddacaef77f1229602ad5e1dabe", "subject": "Defer ending launcher power mode hint until after transient transition", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/frameworks/base", "sha": "8e4462b48e6ed55c300e5fd5c7fa5beef2c3224c", "subject": "Defer ending launcher power mode hint until after transient transition", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288824089" ], "commits": [ { "project": "platform/frameworks/base", "sha": "cd49d1c2523dd5686e50133d70d38cfb92ae0826", "subject": "Revert \"Ignore BIND_ABOVE_CLIENT for same-process connections\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/frameworks/base", "sha": "20c54d969cff59e1302ad0fb0ea8462bae68b97a", "subject": "Revert \"Ignore BIND_ABOVE_CLIENT for same-process connections\"", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "268192609" ], "commits": [ { "project": "platform/frameworks/base", "sha": "486cd9726e7f6bbc4f83c14c1e190fcf476adcd5", "subject": "Ensure the getCredentialType cache gets enabled", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] }, { "project": "platform/frameworks/base", "sha": "cf48524a73c0101a31097644c842c7a357d0ee62", "subject": "Ensure the getCredentialType cache gets enabled", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286882367" ], "commits": [ { "project": "platform/frameworks/base", "sha": "40a594324a20baf7ad152cb960f9aaac153b44ce", "subject": "Add permission check for RemoteTransition in ActivityOptions", "tag": "android-security-14.0.0_r2", "merged": "2023-07-18", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291127800" ], "commits": [ { "project": "platform/frameworks/base", "sha": "8b6a1dd2afa9ea2cb3948641779cb7b6cfc36469", "subject": "Change Ellipse values to old bounding box", "tag": "android-security-14.0.0_r2", "merged": "2023-07-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290413333" ], "commits": [ { "project": "platform/frameworks/base", "sha": "cfd3c5b4cda22cf55b0d92f0b5da1368cf591525", "subject": "Ensure onStop before onPictureInPictureModeChanged", "tag": "android-security-14.0.0_r2", "merged": "2023-07-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288233136" ], "commits": [ { "project": "platform/frameworks/base", "sha": "1dd373636339981332d0f1d7604e05fa09360fe3", "subject": "Force Software Rendering for KeyguardClockFrame", "tag": "android-security-14.0.0_r2", "merged": "2023-07-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289909028" ], "commits": [ { "project": "platform/frameworks/base", "sha": "2ff070026f4ee8c5f30ba208bbc28f01ea19003d", "subject": "Hide alternateBouncer onTrustChanges, not biometricAuth", "tag": "android-security-14.0.0_r2", "merged": "2023-07-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287989186" ], "commits": [ { "project": "platform/frameworks/base", "sha": "34e436724826ea9f487a50c6f0b1b85183509e3c", "subject": "Make mCurrentPipTaskToken null when app crashes", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290319270" ], "commits": [ { "project": "platform/frameworks/base", "sha": "2018c32e802d7be3192ffdb7e644622943436052", "subject": "Do not capture activity snapshot if starting window is associated to task.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288270962" ], "commits": [ { "project": "platform/frameworks/base", "sha": "6c671fca1e0884d2191a6996fbdbdf38a2cd9e48", "subject": "Fix for ScrollView absorbing fling stretch", "tag": "android-security-14.0.0_r2", "merged": "2023-07-13", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287072561", "290316219" ], "commits": [ { "project": "platform/frameworks/base", "sha": "e17bc744e357e233878d2a0fe13c0d7779cd6a74", "subject": "Update lockscreen shortcuts color tokens", "tag": "android-security-14.0.0_r2", "merged": "2023-07-13", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "275486055", "286779126", "290277152" ], "commits": [ { "project": "platform/frameworks/base", "sha": "a004c226595ed1ee08620d9f895fa4ab78fce98a", "subject": "Disable memory trimming on AoD and on unlock", "tag": "android-security-14.0.0_r2", "merged": "2023-07-12", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289435946" ], "commits": [ { "project": "platform/frameworks/base", "sha": "9e7491f303b05e7f9f51e2cb5b9b1d3dfe807047", "subject": "Enable the CredentialManager Registry API", "tag": "android-security-14.0.0_r2", "merged": "2023-07-12", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290684762" ], "commits": [ { "project": "platform/frameworks/base", "sha": "b4f372a76ea5d72895a52459d7affc6169d569c3", "subject": "Relax policy for non-dismissible calls", "tag": "android-security-14.0.0_r2", "merged": "2023-07-12", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "279928682" ], "commits": [ { "project": "platform/frameworks/base", "sha": "10ae5fc66a9451c3ccde763de20b9af3c7aecea3", "subject": "Issue scheduleWatchdog command on background thread", "tag": "android-security-14.0.0_r2", "merged": "2023-07-12", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287476371" ], "commits": [ { "project": "platform/frameworks/base", "sha": "a4d380fe142812ec1770601376f04a22f993ba57", "subject": "Make SDK sandbox BAL check multi-user aware", "tag": "android-security-14.0.0_r2", "merged": "2023-07-11", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285298304" ], "commits": [ { "project": "platform/frameworks/base", "sha": "a71160be47abd3ef56e501eb74eca562023dee42", "subject": "[Status Bar] Use `defaultDataSubId` flow to trigger config re-fetch.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-11", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287729934" ], "commits": [ { "project": "platform/frameworks/base", "sha": "be27ce9406d22ca33528e941e97ba07fe0312e76", "subject": "Fix no AVD transfer to client when using setOnExitAnimationListener", "tag": "android-security-14.0.0_r2", "merged": "2023-07-11", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285666217" ], "commits": [ { "project": "platform/frameworks/base", "sha": "8947c9ebae60bfe65c3c9506526a7baff7866b23", "subject": "Suppress IndexOutOfBoundsException when cancelling low light animation", "tag": "android-security-14.0.0_r2", "merged": "2023-07-09", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289103338" ], "commits": [ { "project": "platform/frameworks/base", "sha": "2f708883a5bbc9659d057f2dc89c54b5d485645f", "subject": "Fix inSampleSize != 1 gainmap decoding", "tag": "android-security-14.0.0_r2", "merged": "2023-07-07", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288235975" ], "commits": [ { "project": "platform/frameworks/base", "sha": "e4300edc907e365a070935c058e3b96afd1b80e8", "subject": "Inform the falsing manager about UDFPS touches on down", "tag": "android-security-14.0.0_r2", "merged": "2023-07-07", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289485377" ], "commits": [ { "project": "platform/frameworks/base", "sha": "2b1e90dd8a119ee347a482cee37f4bdb67cdbc9b", "subject": "Add traces around updateZenModeConfig", "tag": "android-security-14.0.0_r2", "merged": "2023-07-07", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284902478" ], "commits": [ { "project": "platform/frameworks/base", "sha": "65f176c00155826344c8d1096f8fbbb53e84dc8d", "subject": "Prevent lock icon a11y when unlocking.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-07", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287691671" ], "commits": [ { "project": "platform/frameworks/base", "sha": "cdd5597142616ed8cf6d8ac7e64fa7e3043881b8", "subject": "Synchronize increment of resource cache generations", "tag": "android-security-14.0.0_r2", "merged": "2023-07-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288581490" ], "commits": [ { "project": "platform/frameworks/base", "sha": "e6abcdca1a9b8e51a149d8c86dd5d04335349249", "subject": "Send all-window-drawn message of caller directly", "tag": "android-security-14.0.0_r2", "merged": "2023-07-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283479104" ], "commits": [ { "project": "platform/frameworks/base", "sha": "96f2778cebfcf240452cce91ce440a9de5f94a12", "subject": "Fix media being stretched during the wake-up/unlock animation", "tag": "android-security-14.0.0_r2", "merged": "2023-07-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289093165" ], "commits": [ { "project": "platform/frameworks/base", "sha": "a1eeaf4c8fb32c38167b45ca903cb0c8cbd112d1", "subject": "[Output Switcher] Allow subtext and flags on System Route", "tag": "android-security-14.0.0_r2", "merged": "2023-07-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "279129369" ], "commits": [ { "project": "platform/frameworks/base", "sha": "fbf9c5858355b586f9d30b66dfd2bcf1625f94f8", "subject": "Don't set ImageWallpaper to home only the first time", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283783868" ], "commits": [ { "project": "platform/frameworks/base", "sha": "a1d15b9efb8fd81f7d279fe7ccffdefc6392cc34", "subject": "Fixes bad PIP state when opening Maps from the lock screen", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289301086" ], "commits": [ { "project": "platform/frameworks/base", "sha": "3dba4d9d1e3e0b1745482cd1a5b59dd006d04cdd", "subject": "Log plug state chage & other events at boot", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288255642" ], "commits": [ { "project": "platform/frameworks/base", "sha": "331b85c0340ff2e46960992ca88add1f06aa17c0", "subject": "[Output Switcher] Allow volume adjustment for Guest", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "280907903" ], "commits": [ { "project": "platform/frameworks/base", "sha": "3b3bc4c9939b090507a753185b9823aa10e3c990", "subject": "Don't commit invisible on a collecting transient-launch task", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288965420" ], "commits": [ { "project": "platform/frameworks/base", "sha": "58286efba130e7cf932d6a21e6da7aec1cf1a420", "subject": "Skip user consent popup when sending a personal intent into profile owner app", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288279203" ], "commits": [ { "project": "platform/frameworks/base", "sha": "0f46757e803da975592df993b5a42308762a56a0", "subject": "Call finishedCallback after transitioning away from DREAM", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "174229939" ], "commits": [ { "project": "platform/frameworks/base", "sha": "6458bb87d5b88c1bf2484b118aa90bfc1597d438", "subject": "Improve transition between AOD and lockscreen when media is playing for split shade", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286520191" ], "commits": [ { "project": "platform/frameworks/base", "sha": "d31907c064170954185420a978eb24c29929c92b", "subject": "Handle when sim state indicates that it is absent", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286016109" ], "commits": [ { "project": "platform/frameworks/base", "sha": "8025c41fbaef0f14199ea4227e1bf419f7ac9468", "subject": "Make sure to call back View#onCheckIsTextEditor() on the UI thread", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287740047" ], "commits": [ { "project": "platform/frameworks/base", "sha": "865d21d3e33f0db21c4bbf122e3dbe9ad68823d5", "subject": "Fix notifications wrong corners after \"clear all\"", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285242520" ], "commits": [ { "project": "platform/frameworks/base", "sha": "b85caac0aac2e3cd3006817de349d48e347551c7", "subject": "Make PipTransition use animators bounds for unhandled case", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "170ad5b4d61ed7df202c1633ebc00724320174cc", "subject": "Remove the keep clear areas XML tag from Hotseat", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "281476331" ], "commits": [ { "project": "platform/frameworks/base", "sha": "5a57666bdcc62b52d460b5f50ec88fbc16d63fc4", "subject": "Polish home-key from split to pip transition", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "4fdf5684feebd99c4f0973db2df50be55934f5e8", "subject": "Polish home-key from split to pip transition", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "279552279" ], "commits": [ { "project": "platform/frameworks/base", "sha": "f941f167beb2717f3a00bf9aa441b649512ef196", "subject": "Fixing constraint of statusIcons in large screen shade header", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288913298" ], "commits": [ { "project": "platform/frameworks/base", "sha": "0889b07c12d67cf3ab38c9987849206653361c2f", "subject": "Put credman registry-based sessions into PENDING state to start", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284632470" ], "commits": [ { "project": "platform/frameworks/base", "sha": "710428e87b6badbddb7c12b7d76078e880262b80", "subject": "Update thermal related string to support non-phone device", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287264582" ], "commits": [ { "project": "platform/frameworks/base", "sha": "83262a06f07052302c5c30d9f1c56e0daf73366a", "subject": "Guard mRearDisplayPendingOverrideRequest with mLock", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286346098" ], "commits": [ { "project": "platform/frameworks/base", "sha": "d6f22333ddda751dca5dbcfeeb4c99110aa81ea6", "subject": "Avoid fullscreen bounds check while exiting pip", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287508741" ], "commits": [ { "project": "platform/frameworks/base", "sha": "e5ce836545cdbc79369716aed4152fb260d58b24", "subject": "Fix letterbox overlapping with status bar icons after rotating device", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "260055330", "286593457" ], "commits": [ { "project": "platform/frameworks/base", "sha": "fda901d4dac7bb3408e51f37d7f441e43842bfd6", "subject": "[Output Switcher] Fix list order for preference", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287747787" ], "commits": [ { "project": "platform/frameworks/base", "sha": "1fb018a0a45cde93760563837c8335d8e3c9a256", "subject": "Do not dismiss priority children of a group being dismissed", "tag": "android-security-14.0.0_r2", "merged": "2023-06-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288319976" ], "commits": [ { "project": "platform/frameworks/base", "sha": "c079b7bc4f2c48c03830283ceacad425e4a12fb8", "subject": "Removing some shortcut mappings that didn't make to UDC in system info", "tag": "android-security-14.0.0_r2", "merged": "2023-06-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287482590" ], "commits": [ { "project": "platform/frameworks/base", "sha": "9cc61bd67d60abbd87453950b3dd9eed253e884f", "subject": "Fix small analog clock preview", "tag": "android-security-14.0.0_r2", "merged": "2023-06-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283789325" ], "commits": [ { "project": "platform/frameworks/base", "sha": "d777384f0b4af5b445d1f101112ca94657eca42d", "subject": "Fix stalled background thread bug", "tag": "android-security-14.0.0_r2", "merged": "2023-06-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "280105659" ], "commits": [ { "project": "platform/frameworks/base", "sha": "a1922df8275b6ee963102041df8162cbefaf28b2", "subject": "Add logging for b/280105659", "tag": "android-security-14.0.0_r2", "merged": "2023-06-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "282094846" ], "commits": [ { "project": "platform/frameworks/base", "sha": "060c6919bc6a84de250e60774c95cc5eaa85ede1", "subject": "Fix USB power regression when connecting USB headset during phone/voip call.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-27", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287539388" ], "commits": [ { "project": "platform/frameworks/base", "sha": "205d8a479d2d1e0808c36b07ac2a59ade25afe58", "subject": "Skip null surface when validating transition", "tag": "android-security-14.0.0_r2", "merged": "2023-06-27", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286183129" ], "commits": [ { "project": "platform/frameworks/base", "sha": "35dc6f53a27fe88258a8dbe37db2723f0fc3180b", "subject": "Set alpha to 1 if not using alpha animation", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287106712" ], "commits": [ { "project": "platform/frameworks/base", "sha": "17fb9fc6919e42882aa269d6c021413ab96d6889", "subject": "Add MediaRoute2Info#TYPE_REMOTE_SMARTPHONE", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284081256" ], "commits": [ { "project": "platform/frameworks/base", "sha": "e6fceec4ee3e4619897b9c778324bdd7b93d43d0", "subject": "[SettingsProvider] fix notify profile cache for clone-from-parent settings", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "278667073" ], "commits": [ { "project": "platform/frameworks/base", "sha": "c2ad00b665d75e3d1dc68c0feb382f852c4d75c5", "subject": "[res] Preserve the resid order in ThemeKey", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288201932" ], "commits": [ { "project": "platform/frameworks/base", "sha": "973f9e3a71839b00c8d745bcad2ac2d05b6c93e1", "subject": "Remove vkDeviceWaitIdle call when destroying VulkanSurface", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287529343", "287538489", "287689739" ], "commits": [ { "project": "platform/frameworks/base", "sha": "78998ccaf5eebed67c6018a3d192001e7f633ea7", "subject": "Fix CredDesc reg flow bugs", "tag": "android-security-14.0.0_r2", "merged": "2023-06-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288244587" ], "commits": [ { "project": "platform/frameworks/base", "sha": "d560fba3ddb772b3fed5c942c958ba79e68c4afb", "subject": "Fix memory leak of MediaControlPanel", "tag": "android-security-14.0.0_r2", "merged": "2023-06-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285792442" ], "commits": [ { "project": "platform/frameworks/base", "sha": "40ffc1d77a674db21855878340a9f19079bb5967", "subject": "Fix gainmap size for recycled inBitmap in BRD", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "250078085", "288151309" ], "commits": [ { "project": "platform/frameworks/base", "sha": "1d3867d342b7aa14009ac8a3fc0503533fc0585d", "subject": "docs: Fixing typos in Context refdoc", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286942347" ], "commits": [ { "project": "platform/frameworks/base", "sha": "004aa708af87707da570efcc02578b31162f673b", "subject": "Clear calling identity to grant CDM permission when checking device config.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "281711939" ], "commits": [ { "project": "platform/frameworks/base", "sha": "8aa7dcd12db070abea7912d5f8a0c31b471378ba", "subject": "Reparent PiP overlay under task as soon as possible", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "e338982c973fc601ad9ca0746315048de6e525a9", "subject": "Reparent PiP overlay under task as soon as possible", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286729035" ], "commits": [ { "project": "platform/frameworks/base", "sha": "34cf703bdb6721ae35bd3472200a12a1a4910705", "subject": "Also check PiP activity visibility to determine if enter-pip", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "278071711" ], "commits": [ { "project": "platform/frameworks/base", "sha": "1a3415e019d3c097e475262c2595a0fb42914d75", "subject": "Fix volume slider not showing when casting in the background", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286252090" ], "commits": [ { "project": "platform/frameworks/base", "sha": "744507478fd62faea5558d8c2196e8301e5a5e6e", "subject": "[MediaProjection] Clarify createVirtualDisplay exception javadoc", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288217944" ], "commits": [ { "project": "platform/frameworks/base", "sha": "272c70aab421a136764b1f8542ea979f208a74a2", "subject": "Fix javadoc for getPhysicalCameraResults.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "275486055", "287201133" ], "commits": [ { "project": "platform/frameworks/base", "sha": "55d75ec73ce2603d0ba337f1a940803b3a92f25e", "subject": "Don't create copies of Icon bitmaps for Smartspace", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287507148" ], "commits": [ { "project": "platform/frameworks/base", "sha": "306c6f3d05b3fb3b7ef123599707762346da47cc", "subject": "Fix regression in recents animation consumer touchable region", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286025476" ], "commits": [ { "project": "platform/frameworks/base", "sha": "322c9daeeb8064d8001482f6337ca6561284e86d", "subject": "nfc(api): Restore behavior from Android T", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286100443" ], "commits": [ { "project": "platform/frameworks/base", "sha": "1e312795aa04b3d538e334eb5165bef907ea9776", "subject": "Add additional faciliator identifying information", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "282997779" ], "commits": [ { "project": "platform/frameworks/base", "sha": "4cf5a75f378b5378c7d06c2140983d7205727225", "subject": "update TelecomManager docs on when to post a CallSytle notif", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] }, { "project": "platform/packages/services/Telecomm", "sha": "ba646ad71c15da965c62f6f4730299717307cd7d", "subject": "isInSelfManagedCall for (package,user) should return true for calls being setup", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287015744" ], "commits": [ { "project": "platform/frameworks/base", "sha": "3f7fcd05686838011060a3f74fc3b5a8301b0194", "subject": "Consider process proc_state when computing runnableAt.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286476220" ], "commits": [ { "project": "platform/frameworks/base", "sha": "97bb0a84ac7c799bf4301ebd7279e6535d1e7847", "subject": "Apply syncPipSurfaceState synchronously", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "199822700", "283908789" ], "commits": [ { "project": "platform/frameworks/base", "sha": "77df079ce87849781d43c5705a6ff61d8f9b236d", "subject": "Revert \"ExifInterface: Use FileDescriptors whenever we can.\"", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [] }, { "project": "platform/frameworks/base", "sha": "d065a828da8c659f49833d7dbc08c63b9a82827b", "subject": "Revert \"Use a ExifInterface ctor with a file descriptor as a parameter\"", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286541207" ], "commits": [ { "project": "platform/frameworks/base", "sha": "1870389f7733c9135a6948603f53a7d9e28c6703", "subject": "[MediaProjection] Clarify createVirtualDisplay flags javadoc", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285159515" ], "commits": [ { "project": "platform/frameworks/base", "sha": "b5018941c29a5274684d0f45403024a5943adaaa", "subject": "Detach CDM transport upon encountering an secure channel error", "tag": "android-security-14.0.0_r2", "merged": "2023-06-17", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286188365" ], "commits": [ { "project": "platform/frameworks/base", "sha": "91654de31f9397b66b42b612dd465bf8aac999ee", "subject": "Add displayid to WindowInfos test wrapper", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287518258" ], "commits": [ { "project": "platform/frameworks/base", "sha": "cf73fc06f57116c7cf83f3cb599963f173a40220", "subject": "Reland \"Track per-process freezable state in BroadcastQueue.\"", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286818006" ], "commits": [ { "project": "platform/frameworks/base", "sha": "165c521e698a350eb9bdebeeae03afe4d12819d1", "subject": "Trace events while not recording history.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "267678663" ], "commits": [ { "project": "platform/frameworks/base", "sha": "6f92275895b6e42c05fcf80bebae572f1507f6da", "subject": "ANDROID 14 -- SPACE PROGRAM -- LAUNCH IMMINENT", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286339795", "287528018" ], "commits": [ { "project": "platform/frameworks/base", "sha": "d0df1df0f53754275e591d202bc0a2e59bfa4267", "subject": "Add mAllowInputEvents state to the dump", "tag": "android-security-14.0.0_r2", "merged": "2023-06-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287191450" ], "commits": [ { "project": "platform/frameworks/base", "sha": "103188a89c2e143d93a22a8e55f5ead46ee4b7ad", "subject": "Avoid refreshing the media output dialog UI while dismissing.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284422901" ], "commits": [ { "project": "platform/frameworks/base", "sha": "f756b2623fa76b9d0c3ca2ee9f2894856bb1e448", "subject": "Fix crash opening avatar picker in non-en-US locale.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283456173", "283740863" ], "commits": [ { "project": "platform/frameworks/base", "sha": "81453fd24e74cd30e040330de1128b3a12c09037", "subject": "Add ENABLE_NEW_PRIVACY_DIALOG flag", "tag": "android-security-14.0.0_r2", "merged": "2023-06-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286099078" ], "commits": [ { "project": "platform/frameworks/base", "sha": "831787c50d4d74913d5b12d344e25743760aa437", "subject": "Keyguard: use transition state for syncing occlude [RESTRICT AUTOMERGE]", "tag": "android-security-14.0.0_r2", "merged": "2023-06-13", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "281653513" ], "commits": [ { "project": "platform/frameworks/base", "sha": "09c55d36e5b01284ff39e1fdcfff7c83a8a88aa6", "subject": "[DO NOT MERGE] Increase timeout for UIAutomation", "tag": "android-security-14.0.0_r2", "merged": "2023-06-08", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285111529" ], "commits": [ { "project": "platform/frameworks/base", "sha": "87f56277aad9173debceb432663e4feff4e9256d", "subject": "Fix work profile security challenge screen isn't properly shown", "tag": "android-security-14.0.0_r2", "merged": "2023-06-08", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290377931" ], "commits": [ { "project": "platform/frameworks/native", "sha": "56cd9b79ceac33602079e07efcf8cd56ef2afca7", "subject": "Improve updateInputFlinger performance", "tag": "android-security-14.0.0_r2", "merged": "2023-08-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286037469" ], "commits": [ { "project": "platform/frameworks/native", "sha": "5fe59da3a56f15ef7cf97e8b1f5acc176493c99b", "subject": "Lower severity for invalid accessibility hover event stream to ERROR.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283427479", "292539958" ], "commits": [ { "project": "platform/frameworks/native", "sha": "1fd0268011d6f492078e5adcdebbe87dc7fafd29", "subject": "RenderEngine: Limit the size of blur input to the display size", "tag": "android-security-14.0.0_r2", "merged": "2023-07-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "292284515" ], "commits": [ { "project": "platform/frameworks/native", "sha": "c25d8b872b161e65899a1c85a016f2bee15c660e", "subject": "UltraHDR: Add Adobe HDR gain map notice", "tag": "android-security-14.0.0_r2", "merged": "2023-07-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285561686" ], "commits": [ { "project": "platform/frameworks/native", "sha": "ab84e11cb5f3e3d257f78ceae64dff80e8e83315", "subject": "Force HALs to explicitly enable legacy method for clearing buffer caches", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] }, { "project": "platform/system/sepolicy", "sha": "36fe6f0f7084aae2787b573c8add78f88d5e507b", "subject": "Force HALs to explicitly enable legacy method for clearing buffer caches am: 612ab8588f am: 73c779e5fd am: 6e1d399ea5 am: eb690132f9 am: 4151bc0423 am: 394601926f", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] }, { "project": "platform/system/sepolicy", "sha": "3ad02728a6634a30ad8c6baedeb7666f8d3bc82c", "subject": "Force HALs to explicitly enable legacy method for clearing buffer caches", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "277210442" ], "commits": [ { "project": "platform/frameworks/native", "sha": "704ade2ba7ec2f546b5b4757a441bd534d658005", "subject": "Update EGL_GL_COLORSPACE_BT2020_HLG_EXT to the correct value", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "280396539" ], "commits": [ { "project": "platform/frameworks/native", "sha": "1db43995a5e1cda14aaa1079bbcd39a1c8ccb8fc", "subject": "TouchInputMapper: don't check touchpad touches by screen bounds", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284491185" ], "commits": [ { "project": "platform/frameworks/opt/net/wifi", "sha": "96a0ff372ad938779970ab3d1f90aa889176eda6", "subject": "Check if current process is visible before contining scans", "tag": "android-security-14.0.0_r2", "merged": "2023-07-07", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286836535" ], "commits": [ { "project": "platform/frameworks/opt/net/wifi", "sha": "68792e262fcf59ae97486fdbe5f298b9d3c4be49", "subject": "Refactor BaseWifiTracker.Scanner class to prevent infinite scans", "tag": "android-security-14.0.0_r2", "merged": "2023-07-07", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "292467876" ], "commits": [ { "project": "platform/frameworks/opt/telephony", "sha": "df23e5e5af80a273ee411b745f81d07a83d57ff1", "subject": "Check mAdnCache is not null before loading FDN.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "platform/frameworks/opt/telephony", "sha": "06a11f275bc6295c547593f97a9456618e15a0a1", "subject": "Check mAdnCache is not null before loading FDN.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-10", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289197367" ], "commits": [ { "project": "platform/frameworks/opt/telephony", "sha": "c34ea1b7dc343683409e6ae5b389ba683c06b92e", "subject": "Return only subscriptions associted with user for work profile.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "platform/packages/modules/Permission", "sha": "a124075288ce385123efe7478cea776234be079b", "subject": "Allow ROLE_SMS in managed profile conditionally", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289010449" ], "commits": [ { "project": "platform/hardware/google/graphics/common", "sha": "d24fbd0b7b58cf454015325fe4521c1c6896ef27", "subject": "libhwc2.1: revert behavior of setLayerCompositionType()", "tag": "android-security-14.0.0_r2", "merged": "2023-07-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "292197532" ], "commits": [ { "project": "platform/hardware/interfaces", "sha": "9049f9d5692cca576cd3fe20fef98b6bac8dd9c3", "subject": "Set per-test timeout for IRadio 1.2-1.6 VTS to 5m", "tag": "android-security-14.0.0_r2", "merged": "2023-07-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288845345" ], "commits": [ { "project": "platform/libcore", "sha": "58eac3cce4bb8362ea62a68030bd9547a094f39b", "subject": "Keep existing Pattern.splitAsStream API behavior on Android 13 or below", "tag": "android-security-14.0.0_r2", "merged": "2023-07-09", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "278556954" ], "commits": [ { "project": "platform/packages/apps/Contacts", "sha": "63fdf7b65ce312309f2b82a61df7d2b0ed146381", "subject": "Don't allow importing contacts to accounts passed in by intent unless it is valid", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "294228521" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "c02dabfb5973764fbf5dc3c271aaf31d592f61c0", "subject": "Fix return condition in getWorkspacePageTranslationProvider", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285150685", "293131586" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "14b4f9edcc92dfb6161272e17921c3271de9c12b", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "1f5e248da0b95ba396d30bf2ecb71da8a0841ab8", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "4c96e5508268f3719576c5bd96746e2f005d2592", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "781fcebcc8c1edbaee3edd85fc180cb0744daa65", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "5dfa2976bf6ba2eae56dbec3066c0967c7caa0dd", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "0effcbca8480c08cdc1f2386d7a764b4fadae538", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "413a2346cbb6c3dcc4dd05e71a83c83c71994e04", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "ed1503317c37f999c7214b9ef15ddaa34200e05a", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "8d1e9f08dfbac3cc1ad2bafd8c4c17bfa111102a", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "8e263cb930154eab6900a06a218cda2c0598a6f1", "subject": "[Unfold animation] Do not preemptively start the animation if it has run already", "tag": "android-security-14.0.0_r2", "merged": "2023-08-04", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290320302" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "5038853cd7e841dfacd6c428a5424c3ec702e583", "subject": "Log appear animation's scale factor", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] }, { "project": "platform/packages/apps/Launcher3", "sha": "30471b4d6c8e0b0caced395687628dc778f8441c", "subject": "Log appear animation's scale factor", "tag": "android-security-14.0.0_r2", "merged": "2023-08-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291822492" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "628f74bd7183cc4a07266487d8b30f362bd80575", "subject": "Disable FOLDABLE_SINGLE_PAGE", "tag": "android-security-14.0.0_r2", "merged": "2023-08-01", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289609734" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "c59599dc1970324c39e4b85bc6dfeb647baf2b74", "subject": "Removing obsolete call to start home activity with shell transitions", "tag": "android-security-14.0.0_r2", "merged": "2023-07-26", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288493929" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "ca4e39d402d6bc8453f51834461c1543ff5b84e4", "subject": "Fix the issue that on tablet/unfold, the allapps background color is wrong.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-14", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285194839" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "e0600c6bcae2207e7a6e179305d3298605070a8b", "subject": "Handle onFlingFinished onRecentsAnimationStart", "tag": "android-security-14.0.0_r2", "merged": "2023-07-11", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289305591" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "fb8a789fc9d1d1877c04f173f64998c5898e6463", "subject": "Updating materialColorSurfaceContainerHighest color access", "tag": "android-security-14.0.0_r2", "merged": "2023-07-09", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283346744" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "1672e8a367bf56b5e654e0492385b34e3c02ab63", "subject": "Fix an issue with nav bar translations not being updated", "tag": "android-security-14.0.0_r2", "merged": "2023-07-09", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289175232" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "1f6a5f50e522cea404f414dbfe30940fce65532f", "subject": "Ignore recents transition if there are no closing tasks", "tag": "android-security-14.0.0_r2", "merged": "2023-07-09", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "280657266" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "7cc6f650113da7f4435399b9929eabc2b344bd4f", "subject": "Taskbar All Apps Shortcut Menu Acccessibility Focus", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "279514548" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "df537ccdb7eee3dfab6eb8cda662d26110e86279", "subject": "Cleans up bad state when transient taskbar shows on home.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286016555" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "5cdfa120df03fd9d983c8469508d7d73bd1198c7", "subject": "Workaround for handling the restart of an already visible task", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "236226779" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "8a7181d45ea5f3d4e228a92c4113585337264461", "subject": "Prevent exception when quick switching between two split pairs", "tag": "android-security-14.0.0_r2", "merged": "2023-06-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284106887" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "18f815a7fda64344783c8b92be7d60153c2e50e8", "subject": "Restore strong reference to animation runner", "tag": "android-security-14.0.0_r2", "merged": "2023-06-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288829919" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "5148c096e1f99d2c88158ba5b6deb3c50a01e587", "subject": "Fix NPE due to invalid RecentsView access", "tag": "android-security-14.0.0_r2", "merged": "2023-06-27", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288126260" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "c27a43ba305145ad8ab6a0ca8a06cf8d53714f51", "subject": "Restore specific colors for floating rotation button", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "269956477" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "8f19421a874c002c4a61518115dc6f15ce5f4602", "subject": "Add detailed exception for snappedIndex == -1 when dismissing tasks", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "260765455" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "68ca974330c9b8701a5b726cf57deeb8106df8fd", "subject": "Suspend immersive mode autohide while pending transient taskbar timeout", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286144914" ], "commits": [ { "project": "platform/packages/apps/Launcher3", "sha": "ae6beea07b2781b32adb2704558245033b1b81c2", "subject": "Add logs to RemoteTargetGluer for index exception", "tag": "android-security-14.0.0_r2", "merged": "2023-06-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "291684185" ], "commits": [ { "project": "platform/packages/apps/Settings", "sha": "3926192b45f39732eac6957a77dbf99b0f3688b1", "subject": "Import translations. DO NOT MERGE ANYWHERE", "tag": "android-security-14.0.0_r2", "merged": "2023-08-23", "markers": [ "restrict_automerge" ] }, { "project": "platform/packages/apps/Settings", "sha": "bf389dcc0e72e3b6ec61e3990432648503aeb7c1", "subject": "Import translations. DO NOT MERGE ANYWHERE", "tag": "android-security-14.0.0_r2", "merged": "2023-08-23", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285453719", "285455826" ], "commits": [ { "project": "platform/packages/apps/Settings", "sha": "9a23de2531296789fe41920ecb4c0e8e157f70b8", "subject": "Trigger talkback for notification volume change", "tag": "android-security-14.0.0_r2", "merged": "2023-07-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285455826", "285487766", "285529113" ], "commits": [ { "project": "platform/packages/apps/Settings", "sha": "2b49d000b6e7dbcd8833235ace2bd3597d7da50e", "subject": "Add content description to volume title in settings.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286495189" ], "commits": [ { "project": "platform/packages/apps/Settings", "sha": "e8a85a2765e18aeda0074da7be6a9d49685fd2c2", "subject": "Fix NPE in updateAddPreference", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284380876" ], "commits": [ { "project": "platform/packages/apps/Settings", "sha": "b23136041d4d2494227df66331db12f6dc52eefa", "subject": "Fix colors in importance and conversation priority preferences", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287122689" ], "commits": [ { "project": "platform/packages/apps/Settings", "sha": "ddbb5bcd5cba1169f313be4ee570c09a39010510", "subject": "Update tablet help article link (1/2)", "tag": "android-security-14.0.0_r2", "merged": "2023-06-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290183862" ], "commits": [ { "project": "platform/packages/apps/ThemePicker", "sha": "c013bb9b610fafaf0c65691ea88b806a61917c6d", "subject": "Fix crash of resource not found", "tag": "android-security-14.0.0_r2", "merged": "2023-07-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283110249" ], "commits": [ { "project": "platform/packages/apps/ThemePicker", "sha": "59389fc80f6d2d4566929674a6747fcfd9b403fc", "subject": "Import translations. DO NOT MERGE ANYWHERE", "tag": "android-security-14.0.0_r2", "merged": "2023-07-09", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "278649728" ], "commits": [ { "project": "platform/packages/apps/ThemePicker", "sha": "7d0958785e57f3ce1b83be907a842f1f83d26e91", "subject": "Enabled a11y for clock carousel view", "tag": "android-security-14.0.0_r2", "merged": "2023-07-05", "markers": [] }, { "project": "platform/packages/apps/WallpaperPicker2", "sha": "e2515a7189e09f6e81ee841b3625976051d42f1a", "subject": "Added changes for adding a11y changes for the clock carousel", "tag": "android-security-14.0.0_r2", "merged": "2023-07-05", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "278652573" ], "commits": [ { "project": "platform/packages/apps/ThemePicker", "sha": "c7eebc94535bbad45eca51694f392ea14d036b31", "subject": "Adds new mappings to content descriptions for custom clock faces", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "290891913" ], "commits": [ { "project": "platform/packages/apps/Traceur", "sha": "eaf5e6d87f015533739bef4fbc562e1e8e4887a1", "subject": "Remove drain_period_ms option from default config", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "platform/packages/apps/Traceur", "sha": "8b1728b74b39426f9222cdf19a17ea20e5098a6f", "subject": "Remove drain_period_ms option from default config", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/packages/apps/Traceur", "sha": "dfd04b163b51e7d00b4348b4f11566cee729fce3", "subject": "Remove drain_period_ms option from default config", "tag": "android-security-14.0.0_r2", "merged": "2023-08-20", "markers": [] }, { "project": "platform/packages/apps/Traceur", "sha": "3920d2773074ef8b546eead6ab279e308f7b1bc0", "subject": "Remove drain_period_ms option from default config", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/packages/apps/Traceur", "sha": "e721f8af21efca7ecf498859023c282aea7de92a", "subject": "Remove drain_period_ms option from default config", "tag": "android-security-14.0.0_r2", "merged": "2023-08-14", "markers": [] }, { "project": "platform/packages/apps/Traceur", "sha": "288f873ec7957a3aaaeb1dfa8716bf5ef6e0b62d", "subject": "Remove drain_period_ms option from default config", "tag": "android-security-14.0.0_r2", "merged": "2023-08-12", "markers": [] }, { "project": "platform/packages/apps/Traceur", "sha": "faa9b74e70c109416114f22e1163381a1d08bfa3", "subject": "Remove drain_period_ms option from default config", "tag": "android-security-14.0.0_r2", "merged": "2023-08-11", "markers": [] }, { "project": "platform/packages/apps/Traceur", "sha": "47f1fb7edf791860a9dce7b3878b5f3ca8275c21", "subject": "Remove drain_period_ms option from default config", "tag": "android-security-14.0.0_r2", "merged": "2023-08-10", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286954242" ], "commits": [ { "project": "platform/packages/apps/WallpaperPicker2", "sha": "b48b8c7d2c34a86fdd3a6f78d28e0e3935da1ad1", "subject": "Fixes preview on home/lock tabs when wallpaper is live for both screens", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "278659750", "287568610" ], "commits": [ { "project": "platform/packages/apps/WallpaperPicker2", "sha": "8c768720643ba53d2616bd40507ac491cb7291a3", "subject": "Revert^2 \"Fix lock and home screen tab talkback\"", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286160624" ], "commits": [ { "project": "platform/packages/modules/AdServices", "sha": "044b3e6ad974500a2da41c19ef5e33a63b3b1529", "subject": "Add BootCompletedReceiver in ExtServices that triggers AdServices receiver", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "platform/packages/modules/ExtServices", "sha": "d48aa19c9aff45080749e2a0b7dea83ec6af04ba", "subject": "Add BootCompletedReceiver in ExtServices that triggers AdServices receiver", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "285027829" ], "commits": [ { "project": "platform/packages/modules/Bluetooth", "sha": "fd48e3f3222cf5e31733a4b51fb403fddada8cbd", "subject": "[Metrics] Add logging to profile connection attempts", "tag": "android-security-14.0.0_r2", "merged": "2023-06-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "281790117" ], "commits": [ { "project": "platform/packages/modules/Bluetooth", "sha": "2a634f7f30ae9bf5de1d1edd9284f57c995dc195", "subject": "Correct APCF secletion filed for AD type check", "tag": "android-security-14.0.0_r2", "merged": "2023-06-28", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "289094281" ], "commits": [ { "project": "platform/packages/modules/Connectivity", "sha": "c0f65ef449655e0fd74095ef9b77be944a721d61", "subject": "Remove unnecessary override of Parcelable.getStability()", "tag": "android-security-14.0.0_r2", "merged": "2023-07-11", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "281970908" ], "commits": [ { "project": "platform/packages/modules/Connectivity", "sha": "3f0ff5b46e9af28ba67b420808559ff92e827e51", "subject": "Evaluation delay = 8 secs for explicitly selected networks", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] }, { "project": "platform/packages/modules/Connectivity", "sha": "cb4e91c5b503784b2a5dee97530e0695d0168e19", "subject": "Allow firing the LOST_INTERNET intent immediately in config", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286649301" ], "commits": [ { "project": "platform/packages/modules/Connectivity", "sha": "2e50cc9c29f97c03a5edc74c2a8cbd0c05ccbede", "subject": "Never create native network immediately.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286649301", "288149251", "288450518" ], "commits": [ { "project": "platform/packages/modules/Connectivity", "sha": "01a7d32071240b171b19dec5d9eef07787f99dc4", "subject": "Revert \"Always disconnect agents immediately.\"", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "268149573", "283886067" ], "commits": [ { "project": "platform/packages/modules/Connectivity", "sha": "e87ba429b4cccac9725da7d71f49b720e238cfde", "subject": "Have paused keepalives keep their hardware slot", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288429526" ], "commits": [ { "project": "platform/packages/modules/HealthFitness", "sha": "7137bfe956c5c4eb26eb85da3c44029c7eb2a809", "subject": "Add a null check for runningAppProcesses.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-30", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287621918" ], "commits": [ { "project": "platform/packages/modules/IntentResolver", "sha": "6e616930cd005b15ff235b64fb06362dbdf31f93", "subject": "Add an extra to sharesheet's image edit intent", "tag": "android-security-14.0.0_r2", "merged": "2023-06-27", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288278179" ], "commits": [ { "project": "platform/packages/modules/Uwb", "sha": "29df8079cc0e425b489f80f9f6edcb5340a094fa", "subject": "[uwb] Do not update params when app moved to bg", "tag": "android-security-14.0.0_r2", "merged": "2023-06-21", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "242316893" ], "commits": [ { "project": "platform/packages/modules/common", "sha": "aea05924d6858f23f467bf2101a314e7d2abbae7", "subject": "DO NOT MERGE Add sdk modules list in build artifacts root.", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [ "restrict_automerge" ] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "254749391", "265172663" ], "commits": [ { "project": "platform/packages/modules/common", "sha": "3340b711f4656a45850c0883811ab7f2acfab578", "subject": "Bump min_sdk_version for all launched apex modules", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "292160812" ], "commits": [ { "project": "platform/packages/services/Car", "sha": "12c1d7322de69cafd22dee63b8b2c2f0f3bf3d98", "subject": "Fix permission definition for EV_CHARGE_SWITCH.", "tag": "android-security-14.0.0_r2", "merged": "2023-08-01", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "292645991" ], "commits": [ { "project": "platform/packages/services/Car", "sha": "1d846e43e061930fe6e0a827e090466b3a7dfff6", "subject": "Hide CAR_INTENT_ACTION_RECEIVER_SERVICE.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "283198536" ], "commits": [ { "project": "platform/packages/services/Telecomm", "sha": "5bfc458ce9bb2d163d7453fcda3006c284dfc833", "subject": "Move set speakerphone out of async task executor.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-15", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "287687156" ], "commits": [ { "project": "platform/packages/services/Telecomm", "sha": "70a44d35715db2b2c6d856ecd9e2ccc9ae1a81e9", "subject": "Resolve MT Work Profile ECall", "tag": "android-security-14.0.0_r2", "merged": "2023-06-24", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288080553" ], "commits": [ { "project": "platform/packages/services/Telephony", "sha": "c914b6762549df17fff7fbb93b55f77b33c4c3f9", "subject": "Update swisscomm 144/118 emergency number routing", "tag": "android-security-14.0.0_r2", "merged": "2023-06-27", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "288092164" ], "commits": [ { "project": "platform/system/chre", "sha": "36a22ac0495571b5faa7258dfa074c7f3c6ef1d7", "subject": "Correct the flag value for system_server reconnection", "tag": "android-security-14.0.0_r2", "merged": "2023-06-20", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "292636609" ], "commits": [ { "project": "platform/system/core", "sha": "cfd2e50e2db63e98e18418b1ec63eb9272a7425a", "subject": "libprocessgroup: optimize SetAttributeAction::ExecuteForProcess performance", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] }, { "project": "platform/system/core", "sha": "e10d8405a2ec05d5e81dcaa5cdd645a072100989", "subject": "libprocessgroup: fix reset of file_v2_name", "tag": "android-security-14.0.0_r2", "merged": "2023-08-22", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "284963882" ], "commits": [ { "project": "platform/system/libziparchive", "sha": "c2a353e9098b08dd5794efc6e203292a9e15ed58", "subject": "[zip] Disable mmap after cold launch regression", "tag": "android-security-14.0.0_r2", "merged": "2023-06-29", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "167385698", "247108425", "287598331" ], "commits": [ { "project": "platform/test/mts", "sha": "fbb33bd32c5b725186747811d52c19061e1c7438", "subject": "Regenerate the ART MTS definition (2022-09-22).", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [] }, { "project": "platform/test/mts", "sha": "c9aef593d35b60762c3bc1d67815163a5991011a", "subject": "Regenerate the ART MTS definition (2022-09-18 (b)).", "tag": "android-security-14.0.0_r2", "merged": "2023-06-19", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "281630896" ], "commits": [ { "project": "platform/test/vts", "sha": "d55f0872d4a2546c917cdccae7d16bfe6bbf26d5", "subject": "vts-exclude: Correctly exclude failing uwb vts tests", "tag": "android-security-14.0.0_r2", "merged": "2023-07-20", "markers": [] }, { "project": "platform/test/vts", "sha": "c0ba155f8fd740a6138e011d46e76a3556468540", "subject": "Disable failing VtsHalUwbTargetTest on GSI image.", "tag": "android-security-14.0.0_r2", "merged": "2023-07-13", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" }, { "bug_ids": [ "286384153" ], "commits": [ { "project": "platform/tools/security", "sha": "c31822d8b1c748df10f07d9afb4ae3d9f712ef78", "subject": "Fix padding on EC coordinates that are not expected sizes", "tag": "android-security-14.0.0_r2", "merged": "2023-06-16", "markers": [] } ], "tags": [ "android-security-14.0.0_r2" ], "tag": "android-security-14.0.0_r2" } ], "coverage": { "n_ingested_tags": 30, "first_ingested_tag": "android-security-14.0.0_r1", "latest_ingested_tag": "android-security-14.0.0_r30", "window_base_tag": "android-14.0.0_r1", "window_start": "2023-10-04", "partial_tags": [] }, "platform_update_tags": { "android-security-14.0.0_r2": 597 }, "briefs": { "CVE-2023-40100": { "cve": "CVE-2023-40100", "summary": "Makes Dns64Configuration reference counted (RefBase) and has the detached DNS64 prefix discovery thread capture a strong pointer (sp) to it instead of a raw this, so the object outlives the thread; ResolverController now owns it through android::sp.", "component": "platform/packages/modules/DnsResolver, DNS64 / NAT64 prefix discovery (Dns64Configuration, ResolverController)", "weakness": "Use-after-free (lifetime of an object referenced from a detached thread)", "root_cause": "Dns64Configuration::startPrefixDiscovery (Dns64Configuration.cpp) spawns a std::thread whose lambda captured a raw `this` and used it (explicitly and implicitly) to access shouldContinueDiscovery, mGetNetworkContextCallback, recordDns64Config, mMutex and mCv. The thread is detached from the binder thread that requested discovery and retries with a backoff (maximum retransmission time 3600 s per index search). ResolverController held Dns64Configuration by value (`Dns64Configuration mDns64Configuration;`), so nothing tied the object's lifetime to the running thread. Per the commit message, the object can be destroyed during dnsresolver destruction while the discovery thread still uses it, which gives a use-after-free.", "fix_analysis": [ "Dns64Configuration.h: `class Dns64Configuration` now derives `virtual public RefBase` (include ), which makes instances reference counted.", "Dns64Configuration.cpp:startPrefixDiscovery: creates `const sp thiz = sp::fromExisting(this);` before spawning the thread and captures `thiz` in the lambda instead of `this`. Every member access in the loop (shouldContinueDiscovery, mGetNetworkContextCallback, recordDns64Config, mMutex, mCv) now goes through `thiz->`, so the thread holds a strong reference for its whole lifetime.", "ResolverController.h / ResolverController.cpp: the member becomes `android::sp mDns64Configuration`. The ResolverController constructor builds it with `sp::make(...)`, which gives fromExisting(this) a valid refcount. All uses (destroyNetworkCache, startPrefix64Discovery, stopPrefix64Discovery, getPrefix64, dump, setPrefix64, clearPrefix64) switch from `.` to `->`.", "Android.bp and tests/Android.bp: add `libutils` to the static_libs of the resolver cc_library and of the unit test cc_test. They also move the fuzzer's libutils dependency out of cc_fuzz and into the cc_defaults, as shared_libs for android and static_libs for host." ], "completeness": [ "Covers the only raw-this capture shown in the diff: the detached discovery thread in Dns64Configuration::startPrefixDiscovery. All member accesses inside that lambda go through the strong pointer.", "The fix extends the object's lifetime rather than stopping or joining the thread on destruction. No destructor logic is added, so a running discovery thread keeps the Dns64Configuration alive until it exits on its own (shouldContinueDiscovery false, successful discovery, or exhausted backoff).", "Other things reached from the thread (gResNetdCallbacks via the mGetNetworkContextCallback lambda, sendNat64PrefixEvent via std::bind) are not changed by this fix. The diff does not address their lifetime relative to the thread.", "Correctness relies on every Dns64Configuration being created via sp (sp::make in ResolverController), because sp::fromExisting on an object not already managed by sp would not be safe. The diff shows only the ResolverController construction site." ], "behavior_changes": [ "Dns64Configuration is now heap allocated and reference counted. It stays alive as long as any discovery thread is running, even after ResolverController is destroyed.", "The resolver library now links libutils statically, and the test and fuzzer targets gain a libutils dependency.", "No change to DNS64 discovery semantics, return codes or timing is visible in the diff." ], "preconditions": [ "DNS64 prefix discovery must have been started for a network. Dns64Configuration::startPrefixDiscovery is reached via ResolverController::startPrefix64Discovery. Per index search, the resolver's startPrefix64Discovery is called by Nat464Xlat.startPrefixDiscovery / leaveStartedState in packages/modules/Connectivity.", "The discovery thread must still be running when the owning Dns64Configuration / ResolverController is destroyed (commit message: during dnsresolver destruction).", "The material does not show the exact condition under which the dnsresolver / ResolverController is destroyed in production." ], "per_major": { "14": "same fix: commit de58649ab30a (cherry-pick of 254115584ff5, Change-Id Id74ea4e6f54a00805d3cc8a9d7e15e58a473b7d3) in android-security-14.0.0_r2. At android-security-14.0.0_r29 all 8/8 patched lines are present. Per index search, the android-14.0.0_r75 snapshot shows a std::shared_ptr / shared_from_this form of the thiz capture instead. This does not match the r29 code and is unverified.", "15": "not affected per the bulletin (not listed); the patched region is present (8/8 lines) at android-security-15.0.0_r17.", "16": "not affected per the bulletin (not listed); the patched region is present (8/8 lines) at android-security-16.0.0_r8.", "17": "not affected per the bulletin (not listed); the patched region is present (8/8 lines) at android-security-17.0.0_r1." }, "backport_notes": [ "This is a single commit, but all of its parts must be applied together: the RefBase inheritance, sp::make ownership in ResolverController, the thiz capture in startPrefixDiscovery, and the libutils additions in Android.bp and tests/Android.bp (including the fuzzer cc_defaults for android and host). DnsResolver is a mainline module (general platform knowledge)." ], "confidence": "high", "unknowns": [ "What triggers destruction of the ResolverController / Dns64Configuration in a running dnsresolver (the commit message only says dnsresolver destruction).", "Whether a destructor or shutdown path elsewhere stops the discovery thread.", "Whether test code constructs Dns64Configuration outside sp ownership, which would be incompatible with sp::fromExisting.", "Why the index snapshot (android-14.0.0_r75) shows a shared_ptr-based variant while android-security-14.0.0_r29 shows the sp-based fix.", "The original AOSP commit 254115584ff5 and the 11/12/12L/13 branch commits are not included in the material.", "Where gResNetdCallbacks is declared and how long it lives." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 6, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "CVE-2023-40105": { "cve": "CVE-2023-40105", "summary": "Adds a check to ActivityManagerService.backupAgentCreated() that compares the caller's uid with the package's uid, so a caller can only report a backup agent for a package that belongs to its own uid.", "component": "platform/frameworks/base, ActivityManagerService (backup agent callback, services/core/java/com/android/server/am)", "weakness": "Missing authorization check (caller identity not validated against the package named in a Binder API)", "root_cause": "backupAgentCreated(String agentPackageName, IBinder agent, int userId) is a Binder entry point (@Override) in ActivityManagerService. Before the fix it called only mUserController.handleIncomingUser(...) to resolve and check the target user. It never checked that the calling uid owned agentPackageName, so a caller could report a backup agent for a package it does not own. The bulletin classifies this as information disclosure (ID). Per index search, the only uid check on this path is in the app process, in ActivityThread.handleCreateBackupAgent (it compares the requested package's uid to Process.myUid()). That check does not protect the server side.", "fix_analysis": [ "services/core/java/com/android/server/am/ActivityManagerService.java: adds a private helper, enforceCallingPackage(String packageName, int callingUid). It sets userId = UserHandle.getUserId(callingUid) and looks up getPackageManagerInternal().getPackageUid(packageName, /*flags=*/0, userId). If the result differs from callingUid, it throws SecurityException(packageName + \" does not belong to uid \" + callingUid).", "services/core/java/com/android/server/am/ActivityManagerService.java:backupAgentCreated(): reads callingUid = Binder.getCallingUid() once at entry and calls enforceCallingPackage(agentPackageName, callingUid) before handleIncomingUser(). The cached callingUid replaces the later Binder.getCallingUid() calls in the handleIncomingUser argument and the DEBUG_BACKUP log line. The synchronized block is unchanged." ], "completeness": [ "Covers the backupAgentCreated Binder entry point. The new check runs before user resolution and before the synchronized block.", "The lookup uses the caller's own user, not the userId parameter. The call is accepted only if the package resolves to exactly callingUid in that user.", "If the package does not resolve to callingUid in the caller's user (for example, it is not installed there), the call is rejected with SecurityException.", "The client-side check in ActivityThread.handleCreateBackupAgent (per index search) is unchanged. The fix adds server-side enforcement.", "The synchronized block is not shown, and neither are other ActivityManagerService backup APIs. Whether related APIs have comparable checks cannot be judged from this material." ], "behavior_changes": [ "backupAgentCreated now throws SecurityException to any caller whose uid does not equal the uid of agentPackageName in the caller's user. Before the fix, such calls went on to handleIncomingUser and the synchronized block.", "The SecurityException is thrown before handleIncomingUser, so a uid mismatch is reported even for callers that would also have failed the cross-user check.", "Normal calls from the agent's own app process (ActivityThread.handleCreateBackupAgent, per index search) are expected to pass, because that path already checks that the package's uid equals the process uid.", "DEBUG_BACKUP log output now uses the cached callingUid value (no functional difference)." ], "preconditions": [ "The caller can invoke backupAgentCreated over Binder. Before the fix, the only check visible in the diff is handleIncomingUser (ALLOW_FULL_ONLY).", "The caller passes an agentPackageName that it does not own. After the fix, such calls are rejected.", "Normal reachability: per index search, ActivityThread.handleCreateBackupAgent runs in the app process when asked to create a backup agent and reports back to ActivityManagerService." ], "per_major": { "14": "Same fix: [DO NOT MERGE] cherry-pick 06830ff04faa in android-security-14.0.0_r2 (linked by bug 289549315). At android-security-14.0.0_r29 the patched region is fully present (8/8 lines).", "15": "Not affected (not listed by the bulletin). The patched region is present at android-security-15.0.0_r17 (8/8 lines).", "16": "Not affected (not listed by the bulletin). The patched region is present at android-security-16.0.0_r8 (8/8 lines).", "17": "Not affected (not listed by the bulletin). 7/8 lines of the patched region are present at android-security-17.0.0_r1. The differing line is not shown." }, "backport_notes": [ "The patch is self-contained in ActivityManagerService.java. It depends on getPackageManagerInternal() and PackageManagerInternal.getPackageUid(String, flags, userId). On older branches, confirm that the local signature accepts the flags argument (general platform knowledge)." ], "confidence": "high", "unknowns": [ "What the synchronized block in backupAgentCreated does with the supplied agent binder (not shown), and therefore the exact nature of the information disclosed.", "Whether the CTS test named in the commit (ActivityManagerTest#testActivityManager_backupAgentCreated_rejectIfCallerUidNotEqualsPackageUid) landed with the fix on each branch.", "Which line of the patched region differs at android-security-17.0.0_r1.", "Which permission checks, if any, exist inside the synchronized block." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 7, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "CVE-2023-40106": { "cve": "CVE-2023-40106", "summary": "Replaces Notification.setAllowlistToken(null) with a new clearAllowlistToken() that also nulls the allowlist token on the nested publicVersion Notification before NotificationManagerService returns an app's own notifications to it.", "component": "platform/frameworks/base, Notification / NotificationManagerService", "weakness": "Incomplete sanitization: a privileged token was stripped from the outer object but not from a nested copy (notification.publicVersion) before returning data to an untrusted caller", "root_cause": "NotificationManagerService.sanitizeSbn clones a Notification and calls setAllowlistToken(null) so that an app retrieving its own notifications does not get back the background allowlist token (the commit message says this token lets the app fire its own PendingIntent to launch activities from the background). The Notification.publicVersion field is itself a Notification carrying its own mAllowlistToken, and that nested token was left intact in the returned object.", "fix_analysis": [ "core/java/android/app/Notification.java: the @hide setter setAllowlistToken(IBinder) is replaced by clearAllowlistToken(), which sets mAllowlistToken = null and, if publicVersion != null, recursively calls publicVersion.clearAllowlistToken().", "services/core/java/com/android/server/notification/NotificationManagerService.java (sanitizeSbn, called for the calling package's notifications, including snoozed and enqueued ones, per the r29 context): the call notification.setAllowlistToken(null) is changed to notification.clearAllowlistToken(), so both the outer notification and its publicVersion lose the token before the StatusBarNotification is built and returned." ], "completeness": [ "The diff changes the sanitizeSbn call site and clears the token on the outer Notification and, recursively, on any chain of publicVersion objects.", "Only publicVersion is handled. The diff does not show whether any other Notification sub-object can carry an allowlist token, and no other return path is touched by this commit.", "At android-security-14.0.0_r29 the sanitizeSbn call site reads notification.overrideAllowlistToken(null) rather than clearAllowlistToken(). The body of overrideAllowlistToken is not in the material, so the material cannot show whether that later API keeps the publicVersion handling." ], "behavior_changes": [ "Notifications returned through sanitizeSbn now have a null allowlist token on publicVersion as well as on the top-level Notification.", "The @hide method Notification.setAllowlistToken(IBinder) is removed and replaced by clearAllowlistToken(). Any other caller of the old setter would fail to compile (the diff shows none)." ], "preconditions": [ "Caller is an app reaching the NotificationManagerService path that returns its own notifications through sanitizeSbn (per the r29 context this includes snoozed and enqueued notifications for the calling package/user).", "The app's posted notification has a non-null publicVersion, so a nested Notification with its own mAllowlistToken is returned." ], "per_major": { "14": "same fix: commit 7ac1135a7f85 in android-security-14.0.0_r2 (bug 278558814). At android-security-14.0.0_r29 the call site has since changed to notification.overrideAllowlistToken(null) (6/8 patched lines present).", "15": "not affected per the bulletin. At android-security-15.0.0_r17, 6/8 lines of the patched region are present.", "16": "not affected per the bulletin. At android-security-16.0.0_r8, 6/8 lines of the patched region are present.", "17": "not affected per the bulletin. At android-security-17.0.0_r1, 6/8 lines of the patched region are present." }, "backport_notes": [ "Single commit, two files. When backporting, rename every caller of the @hide Notification.setAllowlistToken(IBinder) (only sanitizeSbn appears in the diff) or keep the old setter alongside clearAllowlistToken(). On trees that already use overrideAllowlistToken(null), check that this method also clears publicVersion, since the material does not show its body." ], "confidence": "high", "unknowns": [ "Body of Notification.overrideAllowlistToken, used at android-security-14.0.0_r29, and whether it recurses into publicVersion.", "Whether other Notification fields besides publicVersion can carry an allowlist token.", "Whether other service paths return Notification objects to apps without going through sanitizeSbn.", "Name of the binder method that calls sanitizeSbn and the full set of its call sites." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 5, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "CVE-2023-40107": { "cve": "CVE-2023-40107", "summary": "Adds `mVPSBuf = NULL;` to the single-argument `ARTPWriter::ARTPWriter(int fd)` constructor in media/libstagefright/rtsp/ARTPWriter.cpp. Before this, the VPS buffer pointer was left uninitialised while mSPSBuf and mPPSBuf next to it were already initialised.", "component": "platform/frameworks/av, libstagefright RTSP (ARTPWriter)", "weakness": "Use of uninitialised pointer leading to an invalid free (missing member initialisation)", "root_cause": "`ARTPWriter::ARTPWriter(int fd)` set `mSPSBuf = NULL` and `mPPSBuf = NULL` but never initialised the sibling member `mVPSBuf`. Per the commit message, if the ARTPWriter object is cleared immediately after this constructor call, the uninitialised pointer could lead to an incorrect free. The material does not show the clearing code itself. The bulletin rates this as a High severity EoP.", "fix_analysis": [ "media/libstagefright/rtsp/ARTPWriter.cpp:ARTPWriter::ARTPWriter(int fd): one line is added, `mVPSBuf = NULL;`. It sits just before the existing `mSPSBuf = NULL;` and `mPPSBuf = NULL;` assignments (line 108 at android-security-14.0.0_r29). Because the pointer now starts as NULL, a later clear of a freshly constructed object no longer sees an indeterminate value." ], "completeness": [ "Covers only the single-argument constructor `ARTPWriter(int fd)`. It is the only constructor the commit changes.", "The second constructor `ARTPWriter(int fd, String8& localIp, int localPort, String8& remoteIp, int remotePort, uint32_t seqNo)` (line 127) is in the same file. Its body is not included in the material, so we cannot tell from the code shown whether it initialises mVPSBuf.", "The fix does not change the code that frees the buffers. It relies only on the pointer being NULL at construction." ], "behavior_changes": [ "Nothing observable is expected: mVPSBuf now starts as NULL, so clearing a VPS buffer that was never set no longer acts on an indeterminate pointer. There are no new error paths, return codes or validation." ], "preconditions": [ "An ARTPWriter must be constructed via `ARTPWriter(int fd)` and then cleared before a VPS buffer has been assigned (per the commit message: the object is cleared immediately after the constructor call).", "ARTPWriter is declared in frameworks/av/media/libstagefright/rtsp/include/media/stagefright/rtsp/ARTPWriter.h as a MediaWriter subclass. Per index search, no users outside frameworks/av appeared among the top results. The exact caller that triggers the issue is not shown; the commit was tested with rtp_writer_fuzzer." ], "per_major": { "14": "same fix: commit 1a233e80bc31 landed in android-security-14.0.0_r2 (cherry-picked through partner and googleplex review). At android-security-14.0.0_r29 both lines of the patched region are present.", "15": "not affected (not listed by the bulletin); the patched region is present at android-security-15.0.0_r17.", "16": "not affected (not listed by the bulletin); the patched region is present at android-security-16.0.0_r8.", "17": "not affected (not listed by the bulletin); the patched region is present at android-security-17.0.0_r1." }, "backport_notes": [ "A single self-contained one-line change with no dependencies: add it next to the existing `mSPSBuf = NULL;` in `ARTPWriter::ARTPWriter(int fd)`. When backporting, also check whether the six-argument constructor in the same file initialises mVPSBuf, since its body is not shown in the material." ], "confidence": "high", "unknowns": [ "Which clear/free routine in ARTPWriter frees mVPSBuf, and which concrete caller clears the object immediately after construction (the material only gives the commit message and the fuzzer name).", "Whether the six-argument `ARTPWriter(...)` constructor initialises mVPSBuf; its body is not included.", "Whether mVPSBuf is declared with an in-class initialiser in ARTPWriter.h (the header excerpt does not show the member declarations)." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 4, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "CVE-2023-40109": { "cve": "CVE-2023-40109", "summary": "UsbConfiguration.CREATOR.createFromParcel now uses the type-safe Parcel.readParcelableArray(ClassLoader, Class) overload with UsbInterface.class, so a non-UsbInterface element in the interfaces array is rejected when a UsbConfiguration is unparceled.", "component": "platform/frameworks/base, android.hardware.usb (UsbConfiguration Parcelable)", "weakness": "Missing type validation of Parcelable array elements during Parcel unmarshalling (type confusion)", "root_cause": "In core/java/android/hardware/usb/UsbConfiguration.java, the Parcelable.Creator read the interfaces array with the untyped in.readParcelableArray(UsbInterface.class.getClassLoader()), which did not restrict elements to UsbInterface. setInterfaces() only runs Preconditions.checkArrayElementsNotNull, and getInterface() casts mInterfaces[index] to UsbInterface, so no element-type check existed on the deserialization path.", "fix_analysis": [ "core/java/android/hardware/usb/UsbConfiguration.java: UsbConfiguration.CREATOR.createFromParcel replaces in.readParcelableArray(UsbInterface.class.getClassLoader()) with in.readParcelableArray(UsbInterface.class.getClassLoader(), UsbInterface.class). Per the commit message test line, unparceling now throws an exception for a non-UsbInterface object.", "No other lines change: setInterfaces(), getInterface() and writeToParcel() are unchanged; the array is still stored as Parcelable[]." ], "completeness": [ "Covers the single deserialization site in UsbConfiguration.CREATOR; element type is enforced at unparcel time.", "setInterfaces(@NonNull Parcelable[]) still accepts any Parcelable[] from in-process callers (documented as 'Only used by UsbService implementation'); the fix addresses the Parcel path only.", "The material shows only UsbConfiguration.java; whether other USB Parcelables use typed reads is not shown." ], "behavior_changes": [ "Unparceling a UsbConfiguration whose interfaces array contains a Parcelable that is not a UsbInterface now fails with an exception in createFromParcel instead of producing an object whose getInterface() cast would fail later.", "No change for well-formed Parcels written by writeToParcel()." ], "preconditions": [ "A process must unparcel a UsbConfiguration from a Parcel whose contents are controlled by another party (the material does not show which IPC paths deliver such Parcels).", "The Parcel must carry a Parcelable class other than UsbInterface in the interfaces array position." ], "per_major": { "14": "same fix: commit d8d48d8689f8 in android-security-14.0.0_r2 (cherry-picked from 85d7e6712a9e / 2c9931533cf8, Change-Id I2917c8331b6d56caaa9a6479bcd9a2d089f5f503); patched region present at android-security-14.0.0_r29 (6/7 lines).", "15": "not affected (not listed by the bulletin); patched region present at android-security-15.0.0_r17 (6/7 lines).", "16": "not affected (not listed by the bulletin); patched region present at android-security-16.0.0_r8 (6/7 lines).", "17": "not affected (not listed by the bulletin); patched region present at android-security-17.0.0_r1 (6/7 lines)." }, "backport_notes": [ "Single small change in one file (2 insertions, 1 deletion), no other commits involved; check that the target branch provides the typed readParcelableArray(ClassLoader, Class) overload before applying as-is." ], "confidence": "high", "unknowns": [ "Which IPC path or caller delivers an attacker-controlled UsbConfiguration Parcel (the bulletin only rates it High EoP).", "Whether other USB Parcelable classes in the same package use typed or untyped readParcelableArray; only UsbConfiguration.java is in the material.", "How the fix was applied to Android 11/12/12L/13 branches and whether the typed readParcelableArray overload is available there (only the Android 14 commit is provided)." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 6, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "CVE-2023-40110": { "cve": "CVE-2023-40110", "summary": "Adds bounds checks against mBufferSize to MtpPacket::getUInt16, getUInt32, putUInt16 and putUInt32 in media/mtp/MtpPacket.cpp, so reads abort and writes are dropped when offset plus field width exceeds the allocated buffer.", "component": "platform/frameworks/av, media/mtp (libmtp MtpPacket)", "weakness": "Missing bounds check leading to heap buffer overflow (OOB write per the commit message; the read accessors had the same unchecked pattern)", "root_cause": "MtpPacket::getUInt16/getUInt32/putUInt16/putUInt32 indexed mBuffer at offset, offset+1 (and up to offset+3) without comparing against mBufferSize. The commit message says the fuzzer found a write to a buffer index greater than the buffer size (heap OOB write). The read accessors had the same unchecked pattern.", "fix_analysis": [ "media/mtp/MtpPacket.cpp:MtpPacket::getUInt16: only performs the 2-byte read if (unsigned long)(offset+2) <= mBufferSize; otherwise it logs ALOGE and calls abort().", "media/mtp/MtpPacket.cpp:MtpPacket::getUInt32: only performs the 4-byte read if (unsigned long)(offset+4) <= mBufferSize; otherwise it logs ALOGE and calls abort().", "media/mtp/MtpPacket.cpp:MtpPacket::putUInt16: only performs the 2-byte write if (unsigned long)(offset+2) <= mBufferSize; otherwise it logs ALOGE and skips the write (no abort, no return value).", "media/mtp/MtpPacket.cpp:MtpPacket::putUInt32: only performs the 4-byte write if (unsigned long)(offset+4) <= mBufferSize; otherwise it logs ALOGE and skips the write.", "The cast is applied to the int sum offset+N, so the check rejects offsets whose sum exceeds mBufferSize or stays negative. Small negative offsets (for example -1) give a small non-negative sum and are not rejected by this check." ], "completeness": [ "Covers the four fixed-width accessors in MtpPacket.cpp (two reads, two writes). They are checked against mBufferSize (allocation size), not mPacketSize (valid data length), so a read that is inside the allocation but past mPacketSize is still permitted.", "The checks do not reject small negative offsets whose sum with the field width is non-negative.", "Other direct mBuffer accesses in MtpPacket.cpp are untouched: copyFrom memcpys src.mPacketSize bytes after allocate(length), and dump() iterates to mPacketSize. This commit changes neither.", "Dropped writes fail silently (ALOGE only), so callers cannot tell that a putUInt16/putUInt32 was skipped. Out-of-range reads abort the process instead of returning an error.", "The MtpDataPacket::getUInt16(uint16_t&) overload shown by the index search reads mBuffer directly with its own checks and does not go through MtpPacket::getUInt16, so this change does not affect it." ], "behavior_changes": [ "Out-of-range getUInt16/getUInt32 now log an ALOGE and abort() the calling process instead of reading out of bounds.", "Out-of-range putUInt16/putUInt32 now log an ALOGE and do nothing instead of writing out of bounds.", "No API or return-type changes; in-range behavior is identical." ], "preconditions": [ "Code must call MtpPacket getUInt16/getUInt32/putUInt16/putUInt32 with an offset that, plus the field width, exceeds mBufferSize. The commit says the issue was found with mtp_packet_fuzzer; the concrete runtime trigger is not shown.", "Per index search, MtpPacket is the base of MTP packet classes in frameworks/av/media/mtp (e.g. MtpDataPacket). These classes handle MTP protocol data exchanged over USB (general platform knowledge)." ], "per_major": { "14": "same fix: commit ce7ba619260d in android-security-14.0.0_r2 (cherry-picked from a669e34bb8e6, Change-Id Icd0f2307803a1a35e655bc08d9d4cca5e2b58a9b); 8/8 patched lines present at android-security-14.0.0_r29.", "15": "not affected (not listed by the bulletin); the patched lines are present at android-security-15.0.0_r17.", "16": "not affected (not listed by the bulletin); the patched lines are present at android-security-16.0.0_r8.", "17": "not affected (not listed by the bulletin); the patched lines are present at android-security-17.0.0_r1." }, "backport_notes": [ "Single commit touching only media/mtp/MtpPacket.cpp. It uses only the existing mBuffer/mBufferSize members of MtpPacket. The material does not show whether it applies cleanly to the older affected branches (11, 12, 12L, 13).", "The policy is asymmetric: reads abort(), writes only log. The else branches of getUInt16/getUInt32 have no return statement and rely on abort() not returning." ], "confidence": "high", "unknowns": [ "The exact caller and offset computation behind the fuzzer-observed OOB write are not shown in the material.", "Whether the Android 11, 12, 12L and 13 branches received the same cherry-pick, and whether it applies cleanly there (only the Android 14 commit is provided).", "The material does not show which process hosts this code on Android 14, so the impact of the new abort() is not established here.", "Whether any caller can pass a small negative offset that passes the new check is not shown." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 5, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "CVE-2023-40111": { "cve": "CVE-2023-40111", "summary": "The media session service's setMediaButtonReceiver now logs and ignores PendingIntents that target an activity, so a media button receiver can no longer be used to bypass background activity launch restrictions.", "component": "platform/frameworks/base, media session service (services/core/java/com/android/server/media/MediaSessionRecord.java) and MediaSession client API (media/java/android/media/session/MediaSession.java)", "weakness": "Missing input validation: an activity PendingIntent was accepted as a media button receiver, which the commit message describes as enabling a background activity launch bypass.", "root_cause": "In MediaSessionRecord, the session binder stub's setMediaButtonReceiver stored any caller-supplied PendingIntent into mMediaButtonReceiverHolder (via MediaButtonReceiverHolder.create) after checking only the SESSION_POLICY_IGNORE_BUTTON_RECEIVER policy. Nothing checked what kind of PendingIntent it was, so an app could register one that targets an activity. The commit message says this allowed a bypass of background activity launch restrictions.", "fix_analysis": [ "services/core/java/com/android/server/media/MediaSessionRecord.java, setMediaButtonReceiver (session binder stub): after the existing SESSION_POLICY_IGNORE_BUTTON_RECEIVER check and before MediaButtonReceiverHolder.create, a new test `if (pi != null && pi.isActivity())` logs a warning (\"Ignoring invalid media button receiver targeting an activity\") and returns. It does not update mMediaButtonReceiverHolder or call mService.onMediaButtonReceiverChanged.", "media/java/android/media/session/MediaSession.java, setMediaButtonReceiver: the javadoc now says the PendingIntent must not target an activity and that such calls are ignored. It now recommends PendingIntent#getService. The RemoteException handler changes from Log.wtf to e.rethrowFromSystemServer()." ], "completeness": [ "The check runs in system_server for every caller of ISession.setMediaButtonReceiver, whatever the target SDK. There is no CompatChanges gate, unlike the THROW_FOR_INVALID_BROADCAST_RECEIVER gate in setMediaButtonBroadcastReceiver.", "Only pi.isActivity() is rejected. Other PendingIntent kinds are still accepted without further validation.", "The sibling API setMediaButtonBroadcastReceiver takes a ComponentName and already checks package ownership and that the component exists. This change does not touch it.", "setSessionActivity / setLaunchPendingIntent is documented to take an activity intent for UI and is unchanged.", "Per the commit message, on Android U the enforcement only ignores the call and logs a warning. The behavior of the original change (ag/23810567) is not shown in the material." ], "behavior_changes": [ "Calling MediaSession.setMediaButtonReceiver with an activity PendingIntent is now silently ignored by the service, with a Log.w in system_server. Any previously stored receiver is kept, and the app gets no exception.", "A RemoteException in the client-side MediaSession.setMediaButtonReceiver is now rethrown via rethrowFromSystemServer instead of being swallowed with Log.wtf.", "The setMediaButtonReceiver documentation now recommends PendingIntent#getService instead of getActivity." ], "preconditions": [ "A local app that owns a MediaSession calls the deprecated MediaSession.setMediaButtonReceiver (ISession.setMediaButtonReceiver) with a PendingIntent created for an activity.", "The session does not carry the SESSION_POLICY_IGNORE_BUTTON_RECEIVER policy (that path already returns early).", "A media button event is later dispatched to the stored receiver. The material does not show this dispatch path." ], "per_major": { "14": "Same fix: commit 55d3d57cbffc in android-security-14.0.0_r2 (cherry-pick, a backport of ag/23810567). The code at android-security-14.0.0_r29 shows the isActivity() check present in MediaSessionRecord's setMediaButtonReceiver. The per-major check reports 3 of 8 lines of the patched region matching.", "15": "Not affected per the bulletin. 3 of 8 lines of the patched region match at android-security-15.0.0_r17. The Android 15 code itself is not shown.", "16": "Not affected per the bulletin. 3 of 8 lines of the patched region match at android-security-16.0.0_r8. The code is not shown.", "17": "Not affected per the bulletin. 3 of 8 lines of the patched region match at android-security-17.0.0_r1. The code is not shown." }, "backport_notes": [ "Single commit. The server-side check depends only on PendingIntent.isActivity() and the existing SESSION_POLICY_IGNORE_BUTTON_RECEIVER early return in MediaSessionRecord's setMediaButtonReceiver. The enforcement itself is in that server-side check; the client-side part changes the documentation and swaps Log.wtf for rethrowFromSystemServer." ], "confidence": "high", "unknowns": [ "The material does not show the media button dispatch path that sends through mMediaButtonReceiverHolder, so it does not show how or under which identity the activity launch happened.", "The material does not show what the original change ag/23810567 does on later releases (the commit says U only ignores and logs), or why only 3 of 8 lines of the patched region match on 14 to 17.", "The material does not show whether a MediaButtonReceiverHolder can be filled from sources other than setMediaButtonReceiver." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 3, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "CVE-2023-40114": { "cve": "CVE-2023-40114", "summary": "Adds a mutex, condition variable and atomic child-thread counter to MtpFfsHandle so that close() waits (up to 2 seconds) for detached doSendEvent threads spawned by sendEvent() to finish before the handle is torn down, preventing a heap use-after-free of the handle's members from the detached thread.", "component": "platform/frameworks/av, media/mtp (MtpFfsHandle, FunctionFS MTP transport)", "weakness": "Use-after-free caused by a race between a detached worker thread and object teardown (missing thread lifetime synchronization)", "root_cause": "MtpFfsHandle::sendEvent() copies the event payload and launches a std::thread running this->doSendEvent(me), then immediately detaches it. Nothing tracked that thread's lifetime, so MtpFfsHandle::close() and the subsequent freeing of the MtpFfsHandle object could proceed while doSendEvent was still running and still accessing data members of the object (the commit message says a data member was accessed after the object was freed, as found by the mtp_handle_fuzzer).", "fix_analysis": [ "media/mtp/MtpFfsHandle.h: adds three protected members: std::mutex m, std::condition_variable cv, and std::atomic child_threads{0} to count outstanding detached event-sender threads.", "media/mtp/MtpFfsHandle.cpp:MtpFfsHandle::sendEvent: after copying the event data and before creating/detaching the std::thread, takes unique_lock on m, increments child_threads, and unlocks.", "media/mtp/MtpFfsHandle.cpp:MtpFfsHandle::doSendEvent: at the end of the function (after the send result check and delete[] of the copied data), takes the lock, decrements child_threads, unlocks, and calls cv.notify_one() so a waiting close() can proceed.", "media/mtp/MtpFfsHandle.cpp:MtpFfsHandle::close: before io_destroy(mCtx), closeEndpoints() and closeConfig(), takes unique_lock on m and calls cv.wait_for(lk, 2 seconds, predicate child_threads==0), so teardown is delayed until all in-flight doSendEvent threads have completed or the timeout expires." ], "completeness": [ "Covers the sendEvent/doSendEvent detached thread, which is the only std::thread creation visible in the diff; both the increment (before detach) and decrement (end of doSendEvent) are under the mutex.", "The wait in close() is bounded by a 2 second timeout: if a doSendEvent thread is still running past the timeout, close() continues and teardown while the thread is live (including the thread's own later child_threads-- on the object) is not prevented; the fix narrows the window rather than eliminating it.", "Synchronization is only in close(); the diff does not add anything to the destructor, so an MtpFfsHandle destroyed without close() being called first gets no protection (whether the destructor calls close() is not shown in the material).", "The fix does not change doSendEvent to avoid touching this; it only orders teardown after the thread." ], "behavior_changes": [ "MtpFfsHandle::close() may now block for up to 2 seconds while an event-send thread is outstanding.", "sendEvent() and doSendEvent() take a mutex briefly; no change to return values or error codes.", "Adds std::mutex, std::condition_variable and std::atomic members to MtpFfsHandle (object layout change; code using the header must be rebuilt)." ], "preconditions": [ "MtpFfsHandle::sendEvent() must have been invoked, spawning a detached doSendEvent thread.", "MtpFfsHandle::close() and freeing of the handle must occur while that thread is still running, i.e. a race between MTP handle teardown and event delivery.", "The issue was found by the mtp_handle_fuzzer; the bulletin rates it High severity EoP but the material does not describe a concrete non-fuzzer trigger." ], "per_major": { "14": "same fix: commit 1deb1302cfcc in android-security-14.0.0_r2 (cherry-pick of 50bf46a3f621, Change-Id I41dde165a5eba151c958b81417d9e1065af1b411); all 8 patched lines present at android-security-14.0.0_r29.", "15": "not affected per bulletin; patched code (8/8 lines) present at android-security-15.0.0_r17.", "16": "not affected per bulletin; patched code (8/8 lines) present at android-security-16.0.0_r8.", "17": "not affected per bulletin; patched code (8/8 lines) present at android-security-17.0.0_r1." }, "backport_notes": [ "Single self-contained commit touching only MtpFfsHandle.cpp/.h; it needs , , and to be available (the diff does not show added includes, so verify it compiles on the target branch). The bulletin also lists 11, 12, 12L and 13 as affected; the material does not show those branches' code, so check that sendEvent()/doSendEvent() have the same detached-thread structure before applying." ], "confidence": "high", "unknowns": [ "Which specific data member doSendEvent accessed after free (the commit message says a data member, the diff does not identify it).", "Which endpoint and write call doSendEvent uses (not shown in the material).", "Whether ~MtpFfsHandle calls close(), and therefore whether destruction paths that skip close() are protected.", "Whether a 2 second timeout is sufficient in practice for the event send to complete.", "How the patched code reached the 15, 16 and 17 branches.", "Realistic (non-fuzzer) trigger conditions and the privilege boundary behind the High EoP rating are not described in the material." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 4, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } }, "CVE-2023-40115": { "cve": "CVE-2023-40115", "summary": "Replaces the detached log-reader thread spawned in the StatsService constructor with a class-member std::thread. The thread is told to stop (an atomic flag plus a wake-up event pushed into the queue) and joined in the StatsService destructor, so readLogs() can no longer run against a destroyed StatsService.", "component": "platform/packages/modules/StatsD, statsd native service (StatsService pushed-event reader thread)", "weakness": "Use-after-free (thread lifetime vs object lifetime: a detached thread references class members after the owning object is destroyed)", "root_cause": "In statsd/src/StatsService.cpp the constructor created `std::thread pushedEventThread([this] { readLogs(); })` and immediately called `detach()`. readLogs() loops forever: it calls `mEventQueue->waitPop()` and then passes the event on for processing, so it uses `this` and its members for as long as the thread runs. The destructor was empty and nothing tied the thread to the StatsService object. So, as the commit message puts it, pushedEventThread references class members after detaching, and a destroyed StatsService could still be accessed by the running thread.", "fix_analysis": [ "statsd/src/StatsService.h: adds `std::unique_ptr mLogsReaderThread`, `std::atomic mIsStopRequested = false`, and the private method `stopReadingLogs()`.", "statsd/src/StatsService.cpp:StatsService::StatsService: when mEventQueue != nullptr, the reader thread is now created as `mLogsReaderThread = std::make_unique([this] { readLogs(); })` instead of as a detached local thread.", "statsd/src/StatsService.cpp:StatsService::stopReadingLogs: sets mIsStopRequested = true, then pushes a dummy `LogEvent(uid=0, pid=0)` into mEventQueue via `push()` so that a reader blocked in `waitPop()` wakes up.", "statsd/src/StatsService.cpp:StatsService::readLogs: after `waitPop()` returns, checks `mIsStopRequested` and breaks out of the `while (1)` loop before the event is processed.", "statsd/src/StatsService.cpp:StatsService::~StatsService: when mEventQueue != nullptr, calls stopReadingLogs() and then `mLogsReaderThread->join()`. The destructor body therefore blocks until readLogs() has exited, while all members are still alive (members are destroyed after the destructor body)." ], "completeness": [ "Covers the single detached thread created in the StatsService constructor. That thread is now joined in the destructor body, before any member is destroyed.", "The stop path relies on the dummy event push to unblock `waitPop()`. The diff does not use push()'s result, and the material does not show LogEventQueue semantics, so it cannot tell whether the wake-up can be lost (for example, if the queue is full). If it were lost, `join()` would block rather than lead to a use-after-free.", "`mIsStopRequested` is only checked after `waitPop()` returns. This is enough because stopReadingLogs() sets the flag before it pushes the wake-up event.", "This commit changes no other thread creation sites. The android-security-14.0.0_r29 context also shows a call to `onStatsdInitCompletedHandlerTermination()` in the destructor, which is not in this commit. The material does not show where it comes from or why." ], "behavior_changes": [ "Destroying a StatsService now blocks until the readLogs thread has seen the stop request and exited (join), instead of returning immediately.", "During shutdown a synthetic LogEvent (uid 0, pid 0) is pushed into the LogEventQueue. readLogs takes it off the queue and then breaks on the stop check, so it is not processed.", "readLogs() is no longer an unconditional infinite loop: it ends once mIsStopRequested is set." ], "preconditions": [ "A StatsService instance constructed with a non-null LogEventQueue (mEventQueue != nullptr), so that the reader thread is started.", "The StatsService object is destroyed while the reader thread is still running. The commit message mentions the statsd_service_fuzzer in this context, and the test line shows the fix was validated with that fuzzer." ], "per_major": { "14": "Same fix: commit f6a9ca981b93 landed in android-security-14.0.0_r2 (a cherry-pick of an internal change, marked Ignore-AOSP-First). At android-security-14.0.0_r29, 6 of the 8 patched-region lines are present. The code shown there includes the member thread, the stop flag, stopReadingLogs() and the destructor join. The material does not identify the 2 differing lines.", "15": "Not affected per the bulletin. At android-security-15.0.0_r17, 6 of the 8 patched-region lines are present.", "16": "Not affected per the bulletin. At android-security-16.0.0_r8, 6 of the 8 patched-region lines are present.", "17": "Not affected per the bulletin. At android-security-17.0.0_r1, 6 of the 8 patched-region lines are present." }, "backport_notes": [ "This is a single self-contained commit touching only StatsService.cpp and StatsService.h. It uses LogEventQueue `waitPop()` and `push(std::unique_ptr, int64_t*)` and a `LogEvent(uid, pid)` constructor, so check those signatures on the target branch.", "At r29 the destructor also calls onStatsdInitCompletedHandlerTermination(). That call is not part of this commit." ], "confidence": "high", "unknowns": [ "The material does not show LogEventQueue::push()/waitPop() semantics (for example, the return value or behaviour when the queue is full), so it is unknown whether the shutdown wake-up can be missed.", "The material does not show whether any production path in the statsd daemon destroys StatsService while the process keeps running.", "The material does not show how the fix reached Android 11, 12, 12L and 13.", "The material does not show which 2 of the 8 patched-region lines differ in the latest tags of 14 through 17." ], "meta": { "generated": "2026-10-04", "author_model": "claude-fable-5-1", "review_model": "claude-opus-5-5", "review_corrections": 7, "note": "AI-generated from the bulletin, the fixing diffs and their code context, then checked claim by claim by a second model. Statements marked '(general platform knowledge)' are not taken from the material." } } } }, "15": { "counts": { "announced": 0, "certain": 0, "probable": 0, "not_published": 0, "not_covered": 0, "awaiting": 0 }, "advisories": [], "tags": [], "unannounced": [], "coverage": { "n_ingested_tags": 18, "first_ingested_tag": "android-security-15.0.0_r1", "latest_ingested_tag": "android-security-15.0.0_r18", "window_base_tag": "android-15.0.0_r1", "window_start": "2024-09-03", "partial_tags": [] }, "platform_update_tags": {}, "briefs": {} }, "16": { "counts": { "announced": 0, "certain": 0, "probable": 0, "not_published": 0, "not_covered": 0, "awaiting": 0 }, "advisories": [], "tags": [], "unannounced": [], "coverage": { "n_ingested_tags": 9, "first_ingested_tag": "android-security-16.0.0_r1", "latest_ingested_tag": "android-security-16.0.0_r9", "window_base_tag": "android-16.0.0_r2", "window_start": "2025-06-10", "partial_tags": [] }, "platform_update_tags": {}, "briefs": {} }, "17": { "counts": { "announced": 0, "certain": 0, "probable": 0, "not_published": 0, "not_covered": 0, "awaiting": 0 }, "advisories": [], "tags": [], "unannounced": [], "coverage": { "n_ingested_tags": 2, "first_ingested_tag": "android-security-17.0.0_r1", "latest_ingested_tag": "android-security-17.0.0_r2", "window_base_tag": "android-17.0.0_r1", "window_start": "2026-06-16", "partial_tags": [] }, "platform_update_tags": {}, "briefs": {} } }, "bulletin": { "url": "https://source.android.com/docs/security/bulletin/2023-11-01", "latest_version": "1.1", "latest_revision": { "version": "1.1", "date": "November 7, 2023", "notes": "Bulletin revised to include AOSP links" }, "revisions": [ { "version": "1.0", "date": "November 6, 2023", "notes": "Bulletin Published" }, { "version": "1.1", "date": "November 7, 2023", "notes": "Bulletin revised to include AOSP links" } ], "tracked_since": "2026-09-30", "changes_since_tracking": [], "out_of_scope_rows": { "Arm components": 1, "MediaTek components": 6, "Qualcomm closed-source components": 11, "Qualcomm components": 4 }, "note": "changes are only visible from `tracked_since`; earlier revisions of the bulletin cannot be reconstructed. Out-of-scope rows (vendor closed-source, kernel) have no public AOSP code to resolve." } }