CVE-2024-40672 AI-generated analysis

platform/packages/modules/IntentResolver, ChooserActivity (share sheet)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (8 corrections). Verify against the commit before relying on it.

ChooserActivity.onCreate in the IntentResolver module now reads Settings.Global.SECURE_FRP_MODE and, when it is 1, logs, calls super.onCreate and immediately finishes, so the share sheet cannot be launched while Factory Reset Protection enforcement is active.

Root cause

ChooserActivity.onCreate built the share sheet for an android.intent.action.CHOOSER intent without checking the FRP state (Settings.Global.SECURE_FRP_MODE). The commit message shows the sheet can be launched with `am start -a android.intent.action.CHOOSER ...`, so it was reachable while the device was still FRP-locked. The bulletin rates this as a High severity EoP.

How the fix works

• java/src/com/android/intentresolver/ChooserActivity.java:onCreate: the new first statement reads Settings.Global.getInt(getContentResolver(), Settings.Global.SECURE_FRP_MODE, 0). If the value is 1, it logs "Sharing disabled due to active FRP lock." at error level, calls super.onCreate(savedInstanceState), calls finish() and returns. All of this happens before Tracer.INSTANCE.markLaunched(), latency tracking, or any resolver/UI setup.
• java/src/com/android/intentresolver/ChooserActivity.java: adds `import android.provider.Settings;`.
• The default is 0 when the setting is absent, so behavior does not change when SECURE_FRP_MODE is unset.

Completeness

• Gates only ChooserActivity.onCreate in packages/modules/IntentResolver. The check runs at the top of onCreate, before any share-sheet setup in that method.
• The parent class ResolverActivity (ChooserActivity extends ResolverActivity) gets no equivalent check in this commit. The material does not say whether the plain resolver should also be blocked under FRP.
• The check is a single read at creation time and is not re-evaluated later in the activity lifecycle. The material does not show whether that matters.
• No test is added; the commit says it was verified manually.

Behavior changes

• When Settings.Global.SECURE_FRP_MODE == 1, any launch of ChooserActivity finishes immediately with no UI and emits the error-level log line "Sharing disabled due to active FRP lock.".
• No change when the setting is 0 or unset.

Per major

• Android 14: Same fix: commit ccd29124d0d2 merged in android-security-14.0.0_r13 (cherry-pick of 94d1e1e4e953). At android-security-14.0.0_r29 all 8/8 lines of the patched region are present.
• Android 15: Not affected (not listed by the bulletin). At android-security-15.0.0_r17, 7/8 lines of the patched region are present; the exact form is not shown.
• Android 16: Not affected (not listed by the bulletin). At android-security-16.0.0_r8, 7/8 lines of the patched region are present; the exact form is not shown.
• Android 17: Not affected (not listed by the bulletin). At android-security-17.0.0_r1, 7/8 lines of the patched region are present; the exact form is not shown.

Unknowns

• Which component or user can send the CHOOSER intent during FRP in practice (the material only shows an adb trigger).
• Whether a legacy frameworks/base com.android.internal.app.ChooserActivity is still present and reachable on Android 14, and whether it would need an equivalent guard (the index shows only frameworks/base ResolverActivity and the coretests ChooserActivityTest).
• The exact textual difference behind the 7/8 line match on Android 15/16/17.
• Whether ResolverActivity (non-chooser) was intended to be gated as well.

Back to October 2024 · Findings