CVE-2025-22421 AI-generated analysis

platform/frameworks/base, SystemUI status bar (StatusBarIconView / NotificationContentDescription)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (8 corrections). Verify against the commit before relying on it.

SystemUI stops embedding notification title/text/ticker in the accessibility content description of status bar notification icons, passing an empty string instead so only the app name is included.

Root cause

The content-description builder for status bar notification icons (StatusBarIconView.java on Android 14; contentDescForNotification in NotificationContentDescription.kt on Android 15) read Notification.EXTRA_TITLE, Notification.EXTRA_TEXT and tickerText and formatted them, together with the app name, into R.string.accessibility_desc_notification_icon. Accessibility services (e.g. TalkBack highlighting icons, per the commit's test steps) could therefore read notification content from the small icon. The commit message states the content can be read when the full cards are visible, which is the reason given for removing it from the icon description.

How the fix works

• Android 14 (platform/frameworks/base 4ec1792148a5): packages/SystemUI/src/com/android/systemui/statusbar/StatusBarIconView.java, in the method returning R.string.accessibility_desc_notification_icon: deletes the lookup of EXTRA_TITLE, EXTRA_TEXT and tickerText, the title-vs-appName comparison and the titleOrText/ticker fallback, and returns c.getString(R.string.accessibility_desc_notification_icon, appName, "").
• Android 15 (platform/frameworks/base 3b0704fd381a): packages/SystemUI/src/com/android/systemui/statusbar/notification/NotificationContentDescription.kt, contentDescForNotification(c, n): same change in Kotlin, keeping only appName = n.loadHeaderAppName(c) ?: "" and passing an empty second argument.
• Android 15 also updates NotificationContentDescriptionTest.kt: the first test is renamed to notificationWithAllDifferentFields_descriptionIsAppName and now asserts createDescriptionText(n, ""); the three other tests (title matches app name: text, ticker, empty fallbacks) are removed.

Completeness

• Within the shown hunk, all three content sources (EXTRA_TITLE, EXTRA_TEXT, tickerText) are removed from the icon description; the earlier part of the Android 14 method is not shown.
• Only the status bar icon content description is changed. The format call still passes a second argument, now always an empty string; no other a11y surfaces are touched in the shown diffs.
• The Android 14 cherry-pick contains only StatusBarIconView.java; the commit message cites StatusBarIconViewTest but no test change is included in that commit.

Behavior changes

• Accessibility content description of status bar notification icons no longer includes notification title/text/ticker; only the app name is filled in.
• The 'title equals app name, fall back to text, then ticker' logic is gone.
• On Android 15 the unit tests covering title/text/ticker in the description are removed, leaving an app-name-only assertion.

Per major

• Android 14: same fix: platform/frameworks/base 4ec1792148a5 in android-security-14.0.0_r19 modifies StatusBarIconView.java only; at android-security-14.0.0_r29 0/8 lines of the patched region are present.
• Android 15: adapted fix: platform/frameworks/base 3b0704fd381a in android-security-15.0.0_r7 applies the same change to contentDescForNotification in NotificationContentDescription.kt and updates NotificationContentDescriptionTest.kt; at android-security-15.0.0_r17 4/8 lines of the patched region are present.
• Android 16: not affected (not listed by the bulletin); 0/8 lines of the patched region present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); 0/8 lines of the patched region present at android-security-17.0.0_r1.

Unknowns

• The exact name of the Android 14 method is not shown in the hunk header.
• The material does not describe the concrete disclosure scenario (e.g. lock screen or hidden sensitive content).
• Whether other SystemUI a11y surfaces expose the same notification fields is not shown.
• What the 4/8 patched-region line match at android-security-15.0.0_r17 means is not explained.

Back to April 2025 · Findings