CVE-2025-22416 AI-generated analysis

platform/frameworks/base, core/java/com/android/internal/app/ChooserActivity.java (share sheet / intent chooser)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (8 corrections). Verify against the commit before relying on it.

ChooserActivity now checks, through IUriGrantsManager.checkGrantUriPermission_ignoreNonSystem, that the launching caller has read access to the URI behind any URI-type Icon in the caller-supplied ChooserTarget array. If the check fails, the icon is removed from that target.

Root cause

ChooserActivity parses the caller-provided Parcelable array into mCallerChooserTargets in a loop that casts pa[i] to ChooserTarget. Each target was accepted as-is, including its Icon. An Icon of type TYPE_URI or TYPE_URI_ADAPTIVE_BITMAP references a URI, and nothing checked that the caller (getLaunchedFromUid()) had read access to that URI.

How the fix works

• core/java/com/android/internal/app/ChooserActivity.java, caller-targets parsing loop (hunk at new line 689): the old line `targets[i] = (ChooserTarget) pa[i]` is replaced. Each target is now passed to the new hasValidIcon(). If that returns false, the target is replaced by removeIcon(chooserTarget) before it is stored in mCallerChooserTargets.
• ChooserActivity.hasValidIcon(ChooserTarget): returns true if the icon is null or is not of type Icon.TYPE_URI / Icon.TYPE_URI_ADAPTIVE_BITMAP. For URI icons it calls getUriGrantsManager().checkGrantUriPermission_ignoreNonSystem(getLaunchedFromUid(), getPackageName(), getUriWithoutUserId(uri), Intent.FLAG_GRANT_READ_URI_PERMISSION, getUserIdFromUri(uri)). A SecurityException or RemoteException is caught and logged with Log.e, and the method returns false.
• ChooserActivity.getUriGrantsManager(): thin wrapper that returns UriGrantsManager.getService() (IUriGrantsManager).
• ChooserActivity.removeIcon(ChooserTarget): rebuilds the ChooserTarget with the same title, score, componentName and intentExtras but a null icon. The target stays in the list without the icon.
• New imports added: ContentProvider.getUriWithoutUserId, IUriGrantsManager, UriGrantsManager, graphics.drawable.Icon, os.RemoteException.

Completeness

• Covers only the caller-supplied ChooserTarget array that is parsed into mCallerChooserTargets. The diff does not touch any other source of ChooserTarget objects or Icons in this file. The material does not show whether those carry caller-controlled URI icons.
• Only Icon types TYPE_URI and TYPE_URI_ADAPTIVE_BITMAP are checked. Other Icon types pass through unchanged.
• Only FLAG_GRANT_READ_URI_PERMISSION is checked.
• On failure the target is kept and only the icon is dropped. A RemoteException is handled the same way as a denial, so the check fails closed.
• The fix only changes the frameworks/base copy of ChooserActivity. The material does not show whether the separate IntentResolver module chooser (packages/modules/IntentResolver) needed or received an equivalent change.

Behavior changes

• A caller-provided ChooserTarget whose URI icon the caller cannot read is rebuilt with a null icon, and an error line 'Failed to get URI permission for: <uri>' is logged.
• One extra binder call to UriGrantsManager for each caller-provided target that has a URI-type icon.
• Targets with non-URI icons or no icon are unaffected.

Per major

• Android 14: same fix: commit 82aa8527b7da in android-security-14.0.0_r19 (cherry-pick of internal bad47a22/729a07b8). 8/8 lines of the patched region are present at android-security-14.0.0_r29.
• Android 15: same fix: commit ee65c97e3a19 in android-security-15.0.0_r7. The diff is identical; only the offset of the trailing hunk differs (4206 on 15 vs 4305 on 14). 8/8 lines are present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin). The patched region is present (8/8 lines) at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin). The patched region is present (8/8 lines) at android-security-17.0.0_r1.

Unknowns

• The exact semantics of checkGrantUriPermission_ignoreNonSystem (what the '_ignoreNonSystem' qualifier exempts) are not shown in the material.
• The material does not show where in ChooserActivity the URI icon is loaded or what data could be exposed. The bulletin only rates the issue High EoP.
• Android 13 is listed as affected, but the material includes no Android 13 commit or tag status.
• The material does not show whether the packages/modules/IntentResolver chooser, including how it handles caller-supplied chooser actions, needed or received an equivalent change.

Back to April 2025 · Findings