CVE-2024-43765 AI-generated analysis
platform/packages/apps/DocumentsUI, BaseActivity and picker/ConfirmFragment (document picker UI)
DocumentsUI now declares android.permission.HIDE_OVERLAY_WINDOWS and calls Window.setHideOverlayWindows(true) on every BaseActivity window and on the ConfirmFragment dialog window (on S+), so non-system overlay windows are hidden over the picker UI.
Root cause
The DocumentsUI activities derived from BaseActivity and the ConfirmFragment overwrite/open-tree confirmation dialog did not ask the system to hide non-system overlay windows. Other apps' overlay windows could therefore be drawn on top of the picker and its confirmation dialog. The commit describes this as enabling a clickjacking attack. The manifest also did not declare the HIDE_OVERLAY_WINDOWS permission, which the fix adds alongside the setHideOverlayWindows calls.
How the fix works
- AndroidManifest.xml: adds <uses-permission android:name="android.permission.HIDE_OVERLAY_WINDOWS"/>.
- src/com/android/documentsui/BaseActivity.java:onCreate: right after recording mStartTime, calls getWindow().setHideOverlayWindows(true) if SdkLevel.isAtLeastS(). This applies to every activity that extends BaseActivity. Adds the import com.android.modules.utils.build.SdkLevel.
- src/com/android/documentsui/picker/ConfirmFragment.java (dialog creation, onCreateDialog): stores the result of builder.create() instead of returning it directly. If SdkLevel.isAtLeastS(), calls dialog.getWindow().setHideOverlayWindows(true) before returning the dialog, so the dialog's own window is also covered. Adds the SdkLevel import.
- Both calls are gated on SdkLevel.isAtLeastS(), and the manifest declares minSdkVersion 29. Window.setHideOverlayWindows was added in API 31 (general platform knowledge).
Completeness
- Covers all activity windows created through BaseActivity.onCreate and the ConfirmFragment dialog window.
- Only the ConfirmFragment dialog is handled explicitly. This diff does not touch any other DocumentsUI dialog or popup that has its own Window. The material does not show whether such windows exist or whether they need the same change.
- Activities that do not extend BaseActivity, if any, are not covered. The material does not list them.
- Below S (API 31) the SdkLevel gate skips the call, so no overlay hiding applies there even though minSdkVersion is 29.
Behavior changes
- On S and later, non-system overlay windows are hidden while a DocumentsUI activity or the ConfirmFragment dialog is shown.
- DocumentsUI requests one additional permission, HIDE_OVERLAY_WINDOWS.
- No change on devices below S (API 29 and 30) because of the SdkLevel.isAtLeastS() gate.
Per major
- Android 14: same fix: commit 6a1dd25117d5 in android-security-14.0.0_r15 (cherry-pick of 4f610dc48300, Change-Id I511730856be58cad3e13fa50bfac1e1ee2f5fee0). All 8 patched lines are present at android-security-14.0.0_r29.
- Android 15: same fix: commit c8e21a60d784 in android-security-15.0.0_r3. Content is identical; only the BaseActivity hunk position differs. All 8 lines are present at android-security-15.0.0_r17.
- Android 16: not affected (not listed by the bulletin). The patched code (8/8 lines) is present at android-security-16.0.0_r8.
- Android 17: not affected (not listed by the bulletin). The patched code (8/8 lines) is present at android-security-17.0.0_r1.
Unknowns
- The material describes the clickjacking scenario, and which user decision was being hijacked, only through the commit title and bug reference b/233605527.
- Whether DocumentsUI has other dialog or popup windows that would also need setHideOverlayWindows. The diff only touches ConfirmFragment.
- Whether the fix was applied to the Android 12/12L/13 branches, which the bulletin lists as affected. The material gives no per-major facts for them.