CVE-2025-22418 AI-generated analysis

platform/packages/apps/Settings, RingtonePreference (ringtone/sound picker launch)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (9 corrections). Verify against the commit before relying on it.

Settings' RingtonePreference now sets a target package on the ringtone picker intent by calling setPackage() with a new string resource (config_sound_picker_package_name, default com.android.soundpicker), so it no longer sends an implicit ACTION_RINGTONE_PICKER intent.

Root cause

In src/com/android/settings/RingtonePreference.java, the constructor RingtonePreference(Context, AttributeSet) called setIntent(new Intent(RingtoneManager.ACTION_RINGTONE_PICKER)) with no target package or component. That made the intent implicit, so it could resolve to any installed app that declares a filter for ACTION_RINGTONE_PICKER rather than the intended sound picker.

How the fix works

• res/values/config.xml: adds a new non-translatable string resource, config_sound_picker_package_name, with default value com.android.soundpicker. It sits between config_settingsintelligence_slice_supported and config_aosp_emergency_package_name.
• src/com/android/settings/RingtonePreference.java:RingtonePreference(Context, AttributeSet): the intent passed to setIntent() is now new Intent(RingtoneManager.ACTION_RINGTONE_PICKER).setPackage(context.getString(R.string.config_sound_picker_package_name)). This restricts resolution to the configured package. The rest of the constructor (ringtone type, showDefault, showSilent, setUserId) is unchanged.

Completeness

• The fix covers only the intent built in the RingtonePreference constructor. It makes the intent explicit by package (setPackage), not by component.
• The material does not show any other Settings code paths that build ACTION_RINGTONE_PICKER intents or replace this preference's intent, so sibling paths cannot be judged from the diff.
• The target package comes from a string resource in res/values/config.xml, so the protection depends on that value naming the intended sound picker package.

Behavior changes

• The picker intent from RingtonePreference now resolves only to the package named in config_sound_picker_package_name (com.android.soundpicker by default). Other apps that handle ACTION_RINGTONE_PICKER are no longer candidates for this launch.

Per major

• Android 14: same fix: commit ad9fb985df47 in android-security-14.0.0_r19 (cherry-pick, Change-Id I905c0f3ddaf0f488ff2fc3bf1747b6df0d802504). The patched region is present at android-security-14.0.0_r29 (7/8 lines); both the setPackage call and the config string appear in the shown code.
• Android 15: not affected (not listed by the bulletin). The patched region (7/8 lines) is present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin). The patched region (7/8 lines) is present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin). The patched region (7/8 lines) is present at android-security-17.0.0_r1.

Unknowns

• Which extras or result data the picker flow exposes; the material shows only the intent action.
• Whether other Settings code paths build ACTION_RINGTONE_PICKER intents without setPackage.
• What happens at runtime if the configured package is not installed.
• Which line of the 8-line patched region differs in the latest tags (7/8 reported), although both functional changes appear in the shown code.

Back to April 2025 · Findings